Information Security Engineer II

IDEMIA•,

About The Position

IDEMIA Public Security, a division of IDEMIA Group, provides biometric-based solutions for public security, justice and public safety, travel and transport, identity, and access control. The Information Security Engineer II analyzes security event data, investigates and responds to incidents, supports detection and threat-hunting efforts, and contributes to security compliance initiatives. The role works with internal teams, external stakeholders, the Incident Response Lead, and managed security and forensic resources.

Requirements

Bachelor’s degree in computer science, Information Technology, Cybersecurity, or a related field, or equivalent experience.
At least 3 years of experience in security operations or cybersecurity roles.
At least 2 years of hands-on experience with SIEM and EDR technologies.
Fundamental understanding of SIEM technologies, log management, and security analytics.
Hands-on experience conducting incident response investigations and related activities.
Familiarity with the MITRE ATT&CK framework and threat intelligence concepts.
Ability to work independently and collaboratively in a fast-paced environment.
Excellent problem-solving, communication, and analytical skills.

Nice To Haves

Experience with scripting languages such as Python, PowerShell, or Bash.
Security certifications such as Splunk Certified Power User, Splunk Certified Admin, CISSP, CEH, or Security+.

Responsibilities

Analyze security event data to identify potential threats and vulnerabilities.
Triage, investigate, and respond to alerts and security incidents, coordinating with internal teams and external stakeholders.
Develop and implement incident response plans, playbooks, and procedures.
Assist with requests for new detections and tuning existing detections.
Support the Incident Response Lead in coordinating with the company’s Managed Security Service Provider and additional incident response forensics resources as appropriate.
Continuously monitor Splunk for security events; respond to and resolve security incidents; and create alerts and suppressions.
Create Splunk searches to identify emerging threats and organizational risks through threat hunting.
Use additional security tools, including Endpoint Detection Response (EDR) tools, to investigate incidents and monitor malicious activity.
Research current threats and vulnerabilities and escalate associated risks for remediation.
Support compliance initiatives by generating reports and audits using cybersecurity tools.