Cyber Defense Engineer

Join BeyondTrust as a Cyber Defense Engineer, where you will be a front-line defender protecting the enterprise infrastructure and product integrity. You will monitor, investigate, and respond to security events, collaborate with experienced threat hunters and incident responders, and contribute to the integration of AI-driven tools into our workflows.

• Monitor and triage security alerts across SIEM, EDR, and CSPM platforms, investigate alerts to determine scope and severity.
• Participate in or lead incident response engagements from detection through remediation, including evidence collection and forensic analysis.
• Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives.

• Comfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows
• 4+ years of experience in a SOC, security operations, or incident response role
• Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior
• Strong written communication skills; able to document findings clearly and concisely for both technical and non-technical audiences
• Experience with at least one SIEM platform and familiarity with writing search or detection queries
• Familiarity with EDR platforms and cloud environments (IaaS preferred)
• Experience leading or co-leading complex incident response engagements from triage through remediation
• Scripting and automation skills (Python, PowerShell, or equivalent) applied to security workflows
• Experience with identity and access management platforms and cloud security posture management tools
• Familiarity with SOAR platforms or orchestration tools for automated response and enrichment
• Experience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases
• Experience building or contributing to threat intelligence programs or detection-as-code pipelines
• Understanding of the privileged access management landscape and the threat actors that target it
• Track record of evaluating and adopting emerging technologies in a production security environment