Security Operations Engineer - Hybrid

CybaVerse operates a lean, automation-driven security operations function built on our CybaOps platform. We do not run a traditional tiered SOC. There is no conveyor belt of copy-paste alerts, no rigid escalation chain, and no ceiling on what you can get involved in.

As a Security Operations Engineer you will work directly within the operations function, handling real investigations, contributing to detection improvement, and getting hands-on with the tooling that powers the service. You will be expected to think, not just triage. When you spot something that should be automated or improved, you will have the space to say so and help fix it.

This role suits someone who has a solid grounding in security operations, is hungry to develop beyond alert handling, and wants to work in an environment where quality of thinking matters more than time-on-console.

We are not looking for someone to sit in a queue. We are looking for someone who wants to understand what they are seeing, improve how we see it, and get better every week.

WHAT YOU WILL BE DOING

• Investigating security alerts and incidents across endpoint, network, cloud, and identity environments using the CybaOps platform
• Conducting structured threat investigations: building timelines, identifying root cause, and producing clear, client-ready findings
• Contributing to detection improvement: identifying gaps, raising tuning recommendations, and helping write or refine SIEM rules
• Supporting incident response activity, including containment actions and post-incident documentation
• Performing threat hunting across client environments based on intelligence or anomaly-driven hypotheses
• Working with threat intelligence feeds to enrich investigations and identify emerging attacker behaviour
• Documenting findings to a high standard for both internal records and client-facing outputs
• Collaborating with the Head of Security Operations and wider team to improve processes, runbooks, and automation workflows
• Supporting onboarding of new clients including log source validation and initial detection tuning, * A rigid tier-1 alert queue with no room for independent thinking
• A siloed role with a narrow remit and no path to grow
• A culture where junior team members are seen and not heard

WHAT YOU WILL FIND HERE

• Real investigations from day one, not filtered-down leftovers
• A team that values quality of thinking over volume of tickets closed
• Genuine support for your development and clear progression into more senior work
• A company in active growth with interesting clients and a product that is actively evolving

• Hands-on experience in a security operations or incident response role, whether in-house, MSSP, or consultancy
• Solid understanding of the attack lifecycle and common attacker techniques, with working knowledge of MITRE ATT&CK
• Practical experience with SIEM platforms: log analysis, query writing, alert investigation
• Ability to investigate across multiple data sources and piece together a coherent picture of what happened
• Clear written communication - you can explain a technical finding to someone non-technical without losing accuracy
• Genuine curiosity about how things work and why attacks succeed

Desirable:

• Experience with EDR platforms (CrowdStrike, SentinelOne, Microsoft Defender or similar)
• Exposure to SOAR tooling or any scripting/automation for operational tasks (Python, PowerShell)
• Familiarity with cloud environments: Azure, AWS, or GCP log sources and common misconfigurations
• Experience with networktraffic analysis or IDS/IPS alert investigation
• Any threat intelligence or CTI exposure: indicator enrichment, threat actor research
• Relevant certifications such as BTL1, SC-200, CySA+, CEH, or GCIH - useful context but not a barrier

Salary is dependent on experience. We will assess the full range based on what you bring to the role.