Security Operations Engineer
Security Operations Engineer on Revizto's Information Security team: monitors and investigates security alerts across cloud, endpoint, and SaaS environments, leads incident response end-to-end, and engineers detections aligned to MITRE ATT&CK. Core stack includes Microsoft Sentinel, CrowdStrike Falcon, KQL, AWS, and Azure.
- Compensation
- Not disclosed
- Location
- Armenia, Armenia
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- At least 3 years of hands-on experience in a SOC, incident response, or security detection role
- Practical experience with SIEM solutions, preferably Microsoft Sentinel
- Practical experience with EDR platforms, preferably CrowdStrike Falcon
- Ability to write, analyze, optimize, and tune detection queries using KQL or similar query languages
- Solid understanding of cyberattack techniques, threat behaviors, and the MITRE ATT&CK framework
- Strong foundation in AWS and Azure cloud security principles
- Proven experience managing security incidents through their full lifecycle (triage, containment, eradication, recovery, RCA, post-incident reporting)
- Knowledge of security frameworks and standards: ISO 27001, NIST, CIS, SOC 2
- Upper-intermediate (B2) or higher proficiency in English, written and spoken
- Must be based in Germany, Armenia, France, or the UK
Nice to have
- Hands-on proactive threat-hunting experience
- Knowledge of Kubernetes and container security principles
- Basic scripting skills in Python, PowerShell, or Bash
- Professional certifications such as GCIH, GCIA, GCFA, GCTI, Microsoft SC-200, or CrowdStrike CCFA/CCFH
Full description
Revizto enables the people behind the world’s most important structures to do their best work. We connect architects, engineers, contractors, and owners in one shared 2D/3D environment to help deliver complex projects on time and on budget. From airports and hospitals to data centers and large-scale infrastructure, Revizto supports industry leaders in reducing risk, improving collaboration, and delivering better project outcomes.
Built on a gaming engine, Revizto is designed to handle the scale and complexity of modern construction projects while remaining fast, reliable, and accessible across devices and environments — whether teams are in the office or on site.
Responsibilities
- Security Monitoring & Investigation: Monitor, triage, and investigate security alerts and incidents across cloud, endpoint, and SaaS environments, ensuring timely identification and assessment of potential threats.
- Incident Response Management: Lead and coordinate security incident response activities, including containment, eradication, recovery, root-cause analysis, and preparation of comprehensive post-incident reports.
- Threat Detection Engineering: Develop, test, and continuously refine security detection rules to improve accuracy, reduce false positives, and maintain detection coverage aligned with the MITRE ATT&CK framework.
- Proactive Threat Hunting: Conduct proactive threat-hunting activities across cloud, endpoint, and identity telemetry to identify suspicious behavior, emerging threats, and potential security compromises.
- Security Log Analysis: Analyze and correlate security logs and telemetry from AWS, Microsoft Azure/Entra ID, Kubernetes, endpoints, and SaaS applications to detect and investigate potential security incidents.
- Cloud Security & Vulnerability Management: Investigate cloud security findings and vulnerability alerts, collaborate with relevant system owners, and support timely remediation of identified security risks.
- Security Logging & Visibility: Maintain the health, completeness, and reliability of existing security log sources while identifying and onboarding additional sources to improve monitoring and detection coverage.
- Incident Response Documentation: Develop, maintain, and continuously improve incident response runbooks and escalation procedures to ensure consistent and effective handling of security events.
Requirements
- Professional Experience: At least 3 years of hands-on experience in a Security Operations Center (SOC), incident response, or security detection role.
- SIEM & EDR Technologies: Practical experience working with Security Information and Event Management (SIEM) solutions, preferably Microsoft Sentinel, and Endpoint Detection and Response (EDR) platforms, preferably CrowdStrike Falcon.
- Detection Engineering & Query Languages: Ability to write, analyze, optimize, and tune security detection queries using Kusto Query Language (KQL) or similar query languages.