Jobs at LevelBlue

Monitors and responds to complex security incidents as part of a 24/7 threat detection and response team. The role investigates endpoint events, tunes security tools, improves detection policies, documents procedures, supports DFIR teams and customers, performs on-call rotations, and mentors analysts. Candidates need knowledge of incident handling, threat hunting, EDR, system administration, exploit remediation, and security monitoring, with Palo Alto Cortex XDR experience preferred.

Monitor and analyze security events from firewalls, IDS, IPS, SIEM, WAF, and other sources. Respond to threats and customer tickets within SLAs, tune security devices, investigate incidents, communicate with customers, and follow escalation procedures and security best practices.

Leads EU SOC operations while performing hands-on Tier 2/Tier 3 security analysis, incident response, threat hunting, malware and attack investigation, and customer escalations. Coaches analysts, coordinates workload, monitors service metrics, improves operational processes, and supports onboarding. Requires significant SOC or MDR experience, strong Windows and networking knowledge, expertise in at least two security disciplines, fluent English, and fluent French or German. The position is Poland-based with rotating weekend schedules.

Lead client-facing cybersecurity consulting engagements focused on Microsoft Sentinel SIEM engineering, detection content, Microsoft Defender XDR, Purview, Azure security, and SOC optimization. Design and implement analytics, integrations, automation, playbooks, and operational processes; conduct workshops; produce client-ready technical artifacts; advise stakeholders; support pre-sales; and independently manage concurrent engagements.

Provides Tier 3 escalation and advanced security analysis for MDR and MXDR customers. Responsibilities include investigating endpoint alerts, reconstructing attack chains across cloud, identity, email, network, and endpoint environments, responding to active breaches, threat hunting, researching emerging threats and malware, developing hunting queries and threat alerts, and engaging with customers from SOC analysts to executives. Requires strong security operations expertise, multilingual communication, scripting, operating systems, networking, and incident response capabilities.

Own the strategy, roadmap, and commercial success of an AI SOC platform supporting MDR, MXDR, managed network security, and managed cloud security. Drive AI-assisted triage, automation, integrations, APIs, multi-tenancy, partner enablement, and MSSP-scale service packaging. Define network and cloud security capabilities, governance requirements, competitive positioning, pricing, and business cases while presenting to customers, partners, sales teams, and executives. Measure automation, workload reduction, cost-to-serve, adoption, retention, and partner revenue.

The Tax Director will lead international tax strategy, statutory reporting, VAT/GST compliance, tax provision, audits, cross-border structuring, and tax technology improvements. The role partners with Finance, Accounting, Legal, FP&A, auditors, and country controllers across global jurisdictions. Responsibilities include managing tax risk, supporting M&A, monitoring regulatory changes, improving processes, and mentoring tax team members.

Leads client-facing digital forensics and incident response engagements, investigating breaches across endpoints, servers, networks, SaaS platforms, and cloud environments. Responsibilities include incident containment and recovery, evidence collection and analysis, root-cause investigation, report writing, stakeholder communication, and maintaining investigation documentation. The role requires independent project management, occasional travel, after-hours support, and participation in an on-call schedule.

Provides 24/7 threat detection and response for managed security clients. Analyzes complex endpoint security events, investigates incidents, tunes detection and blocking technologies, improves monitoring processes, supports DFIR teams, and handles escalations. The role includes customer interaction, analyst mentoring, documentation, rotating weekend and on-call coverage, and requires fluent German and English while being based and legally authorized to work in the UK.

Provides senior-level security operations support within a 24/7 Threat Detection and Response team. Analyzes complex endpoint security cases, investigates threats, tunes detection and blocking technologies, improves security processes, supports incident response, and mentors analysts. The role serves as a technical escalation point for customers, DFIR teams, and client security teams, with rotating weekend and on-call coverage. Fluency in German and English is required, and the position is UK-based.

Designs, builds, and operates secure, reliable cloud-native infrastructure and delivery pipelines across AWS environments. Automates provisioning, configuration management, machine-image creation, deployments, testing, and release management using Terraform, Packer, Puppet, CI/CD tools, and scripting. Partners with development, QA, and operations teams to establish engineering practices, maintain production platforms, monitor performance, manage repositories, and improve reliability and security.

Leads client-facing digital forensics and incident response engagements, including breach investigation, containment, eradication, recovery, evidence preservation, log analysis, root-cause analysis, and incident reporting. Serves as a primary client contact, coordinates with internal and external stakeholders, manages multiple projects, and supports on-call responses outside standard business hours. Requires strong DFIR expertise, forensic tooling knowledge, analytical ability, and clear technical communication.

The Sales Principal will acquire and grow enterprise accounts across the Mid-Atlantic by selling managed security, detection and response, and related cybersecurity services. Responsibilities include lead generation, relationship building with CXO stakeholders, territory and pipeline management, channel collaboration, forecasting, contract negotiation, upselling, and sales reporting. The role requires enterprise sales expertise, strong communication and negotiation skills, and the ability to develop business strategies and multi-year plans.

Leads hands-on digital forensics and incident response engagements, investigating cybersecurity incidents across endpoints, servers, networks, and cloud platforms. Responsibilities include evidence collection, root-cause analysis, incident containment and recovery, report writing, client presentations, quality control, engagement planning, and mentoring junior staff. The role also manages senior stakeholder relationships, contributes to service procedures, supports on-call response, and may require occasional travel and work outside standard business hours.

Lead client-facing digital forensics and incident response investigations, coordinating incident containment, eradication, recovery, evidence preservation, root-cause analysis, log and artifact analysis, and detailed reporting. The role collaborates with technical, legal, compliance, and vendor teams, manages multiple engagements independently, supports on-call operations, and may require occasional travel and work outside standard business hours.

Manage RFP, RFI, RFQ, and security questionnaire responses from kickoff through submission. Coordinate Sales, Presales, Product, Delivery, and cybersecurity subject matter experts while drafting technically accurate first-pass responses. Maintain proposal repositories, reusable content, and knowledge bases; ensure quality, compliance, formatting, and consistent messaging. Support customer presentations and improve proposal processes, tools, and workflows while developing toward a cybersecurity sales engineering career.

Investigates and responds to cybersecurity incidents through digital forensics, evidence collection, breach analysis, root-cause determination, and recovery support. The specialist analyzes servers, workstations, networks, SaaS platforms, and logs; produces clear incident reports; maintains investigation documentation; and collaborates with DFIR, threat intelligence, legal, compliance, IT, and client teams. The role includes occasional travel, after-hours support, and participation in an on-call schedule.

Designs, implements, and supports managed network security solutions for enterprise customers across global environments. Responsibilities include configuring multi-vendor firewalls, developing security policies, integrating network and cloud security platforms, onboarding and testing services, troubleshooting complex incidents, supporting customer engagements, improving MSS processes, and participating in global on-call rotations. The role focuses on Palo Alto Networks, Fortinet, Cisco, Zscaler, SASE, SD-WAN, and cloud-delivered security technologies.

Leads enterprise cybersecurity consulting engagements across SIEM, SOC, EDR, and managed security service implementations. Responsibilities include architecture, delivery, client workshops, executive briefings, business cases, roadmaps, governance, pre-sales solutioning, and operational handover. The role also mentors consultants, develops service methodologies, manages delivery risks, and advises senior security stakeholders. Candidates need 10+ years of security consulting, managed services, or SOC engineering experience, strong client-facing communication, and expertise in platforms such as Microsoft Sentinel or Splunk.

Sell LevelBlue’s managed security and cybersecurity services to enterprise clients across the Southeast. Responsibilities include territory and account development, lead generation, executive relationship building, channel collaboration, pipeline management, forecasting, contract negotiation, upselling, and sales reporting. The role requires enterprise sales experience, CXO-level engagement, territory management, strong communication and negotiation skills, and success managing complex sales strategies and quotas.