The Team:

This position will be part of the Celonis Global Cyber Defense Team (GCDT) and will cover the North America East Cost time zone. The GCDT is comprised of experienced Incident Response (IR) and Security Operations Center (SOC) personnel who work together closely to keep Celonis safe.

The Role:

This position is primarily responsible for the monitoring of security events and potential security incidents. This person will respond to security events and incidents in accordance with Celonis policies and procedures. The position will also participate in all pre and post incident activities as outlined in the Celonis Information Security Incident Response Plan, as outlined in the duties below.

The work you’ll do:

• -Assist in the development of processes and procedures to help improve detection and response capabilities
•  Assist with building out SOAR capabilities
• Create and test Celonis Defense Procedures and IR Playbooks
• Create Detection Use Cases
• Document relevant incident information into the case management system, detailing the critical data for each incident to develop a historical record
• Monitor the environment, SIEM, and other internal security tools for compliance violations, anomalous behavior, and potential attacks to respond to possible threats to the organization
• Participate in shift turn over meetings between outgoing and incoming teams globally to pass along critical information and ensure any open cases are effectively transitioned
• Perform initial analysis of all new alerts generated by correlation/alerting tools in addition to other external sources that will feed into the SIEM system and other security monitoring tools
• Participate in on-call rotation

The qualifications you need:

• Soft Skills
  • Analysis / Reasoning / Evaluation
  • Communications (Spoken) / Listening
  • Communications (Written)
  • Diligence
  • Practical Judgment
  • Questioning / Fact Finding
  • Organizing and Managing Self
  • Passion / Engagement
  • Practical Judgment
  • Self-Awareness / Self-Development
  • Stress Management
• Technical Skills
  • Familiarity with the following:
    • Application Security
    • Attack Frameworks
    • Cloud Platform Security
    • Container Security
    • Database Security
    • Email Security
    • Endpoint Security
    • Incident Response Frameworks
    • Incident Response Activities
    • Network Security
    • Social Engineering Techniques
  • Fundamental knowledge of the following:
  • Endpoint Detection & Response (EDR) Tooling
  • Log Analysis
  • Security Information & Event Management (SIEM) Tooling

Visa sponsorship is not offered for this role.