Mode of work - Remote

Key Responsibilities:

- Inventory every alert type from the EDR, NDR, identity threat detection, CASB, and enterprise browser platforms, including volume and historical disposition.
- Build a triage decision matrix with Cyber Defence defining enrichment, false positive criteria, escalation criteria, and severity, and document handoffs with our MSSP and EDR MDR provider.
- Build Tines integrations using the credential store and least-privilege service accounts.
- Develop reusable Tines components for enrichment, determination, native tool disposition, and Jira documentation.
- Build, test, and enable playbooks for all in-scope alert types, with error handling and failure alerting.
- Run playbooks in approval mode before enabling autonomous closure, and implement allowlists, audit logging, and a kill switch.
- Instrument metrics for volume, determinations,



analyst overrides, time to triage, and playbook failures.
- Write runbooks for every playbook, deliver knowledge transfer, and provide an exit memo summarizing final automation coverage and disposition performance per source.

Required Qualifications:

- Hands-on SOAR experience building and operating production stories, including credentials, sub-stories, HTTP and API actions, and error handling. Sanitized examples are required.
- Senior role in a SOC, or senior engineering support of a SOC, with a minimum of five years in security operations.
- Experience automating triage and enrichment for EDR and NDR alerts.
- Working knowledge of REST APIs, JSON, and webhooks.

📌 Senior SOAR Engineer (Tines) - Remote (India)
🏢 BEEU TECH
📍 India