信息安全部首席工程师
Lead Engineer, Information Security
Majesco 正在寻找一位信息安全主管工程师，以支持并持续提升我们的安全监控、检测、漏洞管理和事件响应能力。
该职位是信息安全团队中的高级技术贡献者，负责调查安全事件、改进 SIEM 检测逻辑、验证安全日志覆盖情况、减少不必要的误报，并帮助确保安全监控在整个环境中提供有意义且可操作的检测。
成功的候选人应能够熟练进行日常安全运营，并识别提升这些运营效率的机会。这是一个需要动手能力强、具备分析能力、技术责任感，并能跨安全、基础设施、云和其他技术团队协作的角色。
主要职责：
- 及时调查、分类、记录并响应安全警报和事件。
- 开发、测试、调整并维护 SIEM 关联和检测规则。
- 分析重复警报和误报，并在不降低有效安全覆盖的情况下实施适当的调整、例外或检测改进。
- 识别安全监控中的缺口，并确保相关的安全日志和遥测数据被正确地导入 SIEM。
- 验证日志源是否提供支持有效检测和调查所需的事件和数据。
- 支持新系统、应用、云平台和安全技术与安全监控环境的集成。
- 使用 Exabeam、CrowdStrike、Wiz 等安全监控和云安全平台技术。
- 支持漏洞管理活动，包括分析、仪表盘、报告和识别有意义的安全趋势。
- 开发和改进安全仪表盘和报告，以减少手动工作量，并为技术团队和管理层提供有用的信息。
- 协助安全事件调查，包括收集和分析相关日志和安全遥测数据。
- 参与事件响应桌面演练和其他安全准备活动的开发和执行。
- 与其他安全运营团队成员协作，分享技术知识，帮助提升团队流程和能力。
- 识别改进机会
查看英文原文
Majesco is looking for a Lead Engineer, Information Security to support and continuously improve our security monitoring, detection, vulnerability management, and incident response capabilities.
This role will be a senior technical contributor within the Information Security team, responsible for investigating security events, improving SIEM detection logic, validating security log coverage, reducing unnecessary false positives, and helping ensure that security monitoring provides meaningful and actionable detection across the environment.
The successful candidate should be comfortable both performing day-to-day security operations and identifying opportunities to make those operations more effective. This is a hands-on role that requires strong analytical skills, technical ownership, and the ability to work collaboratively across Security, Infrastructure, Cloud, and other technology teams.
Key Responsibilities:
- Investigate, triage, document, and respond to security alerts and events in a timely manner.
- Develop, test, tune, and maintain SIEM correlation and detection rules.
- Analyze recurring alerts and false positives and implement appropriate tuning, exceptions, or detection improvements without reducing meaningful security coverage.
- Identify gaps in security monitoring and help ensure relevant security logs and telemetry are properly ingested into the SIEM.
- Validate that log sources provide the events and data necessary to support effective detection and investigation.
- Support the integration of new systems, applications, cloud platforms, and security technologies into the security monitoring environment.
- Work with technologies such as Exabeam, CrowdStrike, Wiz, and other security monitoring and cloud security platforms.
- Support vulnerability management activities, including analysis, dashboards, reporting, and identification of meaningful security trends.
- Develop and improve security dashboards and reporting to reduce manual effort and provide useful information to technical teams and leadership.
- Assist with security incident investigations, including collection and analysis of relevant logs and security telemetry.
- Participate in the development and execution of incident response tabletop exercises and other security preparedness activities.
- Work collaboratively with other members of the Security Operations team, sharing technical knowledge and helping improve team processes and capabilities.
- Identify opportunities to improve security operations and take ownership of improvements from initial problem identification through implementation and validation.
- Maintain appropriate documentation for detection logic, monitoring coverage, investigations, and operational procedures.
Required Qualifications:
- Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, or a related field.
- 4+ years of hands-on experience in security operations, security monitoring, incident detection and response, vulnerability management, or a related information security discipline.
- Strong hands-on experience in security operations, security monitoring, or incident detection and response.
- Experience working with SIEM platforms, including investigating alerts and developing or tuning detection and correlation rules.
- Understanding of Windows, endpoint, network, application, cloud, and security log sources.
- Ability to analyze security events and distinguish legitimate activity, false positives, and potentially malicious behavior.
- Experience with endpoint detection and response (EDR) technologies such as CrowdStrike or equivalent platforms.
- Understanding of vulnerability management and experience working with vulnerability management or cloud security platforms.
- Working knowledge of common security concepts, including threat detection, incident response, identity and access management, network security, endpoint security, and cloud security.
- Ability to independently investigate technical issues and drive them through resolution.
- Strong written and verbal communication skills, including the ability to explain technical security issues clearly to both technical and non-technical audiences.
- Ability to work effectively across technical teams and collaborate with infrastructure, application, cloud, and security personnel.
Preferred Qualifications:
- Experience with Exabeam or another enterprise SIEM or security analytics platform.
- Experience with Wiz or comparable cloud security and vulnerability management technologies.
- Experience developing detection logic using multiple security data sources.
- Experience onboarding, validating, and maintaining SIEM log sources.
- Familiarity with Sumo Logic or similar log management platforms.
- Experience participating in security incident response investigations and tabletop exercises.
- Experience creating security dashboards, metrics, and automated reporting.
- Scripting or automation experience using PowerShell, Python, APIs, or similar technologies.
- Familiarity with cybersecurity frameworks and practices such as NIST CSF, NIST Incident Response Guidance, MITREATT&CK, CIS Controls, or ISO 27001.
- Relevant industry certifications such as CISSP, Security+, CISM, GIAC, GCIH, GCIA, or equivalent certifications are preferred.
What Success Looks Like
A successful Lead Engineer will not simply process alerts. They will continuously improve the effectiveness of security operations by enhancing detection accuracy, identifying monitoring gaps, reducing avoidable false positives, strengthening log coverage, improving vulnerability visibility, and taking ownership of technical security improvements.
They will demonstrate measurable improvements to the security program through stronger detection coverage, more effective correlation rules, improved visibility into security risks, reduced manual effort through automation, enhanced reporting and metrics, and increased incident response readiness.
They are viewed as a trusted technical resource who proactively identifies problems, drives solutions, and helps elevate the overall maturity of Majesco's security operations capabilities.
Originally posted on Himalayas