Information Security Engineer

TTEC•Austin, TX

3d•$65,000 - $70,000•Remote

About The Position

TTEC is hiring a remote-in-the-US Information Security Engineer to help protect the company from data loss and security events. The role is part of the Security Operations Center (SOC) and works with the Threat Management team to investigate security alerts and threat-hunting leads across technologies such as SIEM, EDR, email security, and cloud platforms. The engineer maintains awareness of changes in the threat landscape, industry trends, and TTEC’s internal operating environment, collaborating with Information Security, IT Operations, Engineering, and vendor technical teams. The position reports to the Information Security Manager. The engineer analyzes security events, develops and validates detections and investigation playbooks, documents findings, and coordinates authorized response activities. The role requires hands-on SOC investigation experience and the ability to interpret host, user, network, and cloud activity.

Requirements

Hands-on SOC experience investigating and responding to security events across two or more of the following: SIEM, EDR, email security, NGFW, cloud platforms, and threat intelligence.
Ability to investigate cloud security events by reviewing identity and access permissions, administrative activity, audit logs, and network access controls, and identify suspicious authentication, privilege changes, and potentially unauthorized access to cloud resources.
Working knowledge of TCP/IP, DNS, HTTP/S, common network services, Windows and Linux security logs, and authentication and authorization concepts, with the ability to apply this knowledge to suspicious host, user, and network activity.
Strong communication and interpersonal skills.
2–3 years of experience in Information Systems or IT security-related functions.

Nice To Haves

Ability to use a scripting language to parse logs, enrich indicators, and automate repetitive investigation tasks, with appropriate validation, error handling, documentation, and protection of sensitive data.
IT degree and/or training.

Responsibilities

Investigate security alerts and threat-hunting leads across SIEM, EDR, email security, cloud, and other technologies.
Correlate SIEM alerts with endpoint processes, authentication events, email artifacts, network connections, and cloud audit logs to build incident timelines, identify affected users and assets, and distinguish benign activity from suspected compromise.
Learn the environments for which the role is responsible and engage with teams to gain further knowledge of them.
Recognize potential, successful, and unsuccessful intrusion attempts and compromises through review and analysis of relevant event data.
Document incident severity, scope, evidence, investigation steps, and recommended actions in case records.
Follow approved response playbooks and escalation procedures; coordinate authorized containment and remediation with system owners; and validate recovery before closing incidents.
Maintain awareness of changes to the threat landscape, industry trends, and the internal operating environment.
Partner with the Threat Management team to develop, test, and refine detection queries and investigation playbooks.
Validate detections against relevant event data, investigate false positives, and document telemetry gaps and recommended improvements.