Kroger Technology & DigitalCincinnati, OH, United States
6 days ago
Job type
Full-time
Job description
Location : Cincinnati, OH
3 days / week onsite
We are seeking a highly skilled and motivated Sr. Security Operations Center Engineer to join our team. In this role, you will be responsible for the technical analysis and appropriate response to cyber investigations and incidents. You will support the assurance of the confidentiality, integrity, and availability of Kroger Co.'s technology enterprise.
Key Responsibilities :
Collaborate with SOC teams for process optimization, tool tuning, integration, information sharing, playbook development, and incident response.
Tune detection rules to align with the evolving threat landscape.
Analyze telemetry, alerts, and log sources across various detection domains.
Gather requirements from customers, onboard data, and assist end users with searches, dashboards, reports, and knowledge objects.
Develop and optimize analytics rules and alert mechanisms to proactively monitor for security threats, anomalies, and operational issues.
Maintain and maximize the integrity and effectiveness of alerting through the creation, periodic review, testing, and validation of custom detection content.
Fine-tune detection rules to minimize false positives and negatives, optimizing threat identification accuracy.
Conduct security investigation analysis and mitigation response.
Manage security incident response and business escalation.
Monitor third-party incidents for impact and actionable response.
Respond to zero-day threats.
Decrease final time to resolution (FTTR) through automation and repeatable runbooks.
Coordinate service, data, identity containment, restoration, and recovery activities tied to security incidents.
Develop response playbooks for various scenarios such as ransomware, phishing, account takeover, payments fraud, and third-party vendor incidents.
Conduct internal HR-related case analysis and evidence gathering.
Provide tactical and strategic support for enterprise EDR (endpoint detection and response) and email gateway.
Perform forensic and malware analysis.
Collect metrics to measure and track security investigation / incident activity, performance, and trends to define priorities and strategy.
Requirements :
Experience and deep understanding of the threat landscape, advanced detection techniques, and threat hunting methodologies.
Understanding of user and service-based patterns in a hybrid environment.
Experience with Kill Chain analysis and threat modeling.
Familiarity with the MITRE ATT&CK Framework.
Demonstrated experience with cloud platforms such as AWS, GCP, or Azure.
Proficiency in rule / alert / notification tuning.
Experience with adversary Tactics, Techniques, and Procedures (TTPs), and ability to identify opportunities to improve the effectiveness of existing detection efforts.