Tech Lead Cyber (Blue Team)

Requisitos

• 7+ years in information security, with at least 4 years in SOC, detection or incident response (level 2/3)
• Technical leadership experience: team reference, mentoring analysts and leading deliveries, even without formal people management
• Mastery of SIEM (Splunk, Sentinel, QRadar, Elastic or similar), preferably multi-client/multi-tenant, and EDR
• Detection engineering experience: creating and tuning rules and use cases (KQL, SPL, Sigma or equivalents)
• Solid knowledge of MITRE ATT&CK, NIST and ISO 27001, and incident investigation experience

Desejáveis

• MSSP or consulting experience serving multiple clients
• Automation and SOAR
• Python or PowerShell scripting
• Certifications such as GCIH, GCFA, GCDA, CISSP, SC-200 or equivalents
• Experience with email protection platforms, DLP and brand monitoring (e.g., Ironscales, Microsoft Purview, Axur)
• Threat hunting, purple team or tabletop exercise experience