Avertium is seeking a Senior Cybersecurity Engineer with strong hands-on experience with USM Anywhere and modern SIEM/XDR technologies. This role will focus on designing, implementing, optimizing, and supporting security monitoring and response solutions across customer environments.
The ideal candidate understands how SIEM and XDR technologies work together to provide centralized visibility, threat detection, investigation, incident response, and security automation. You will serve as a senior technical resource for complex security issues, help improve the effectiveness of our security monitoring capabilities, and support the continued evolution and scalability of our security operations.
While USM Anywhere is the primary platform for this role, candidates with strong experience in other major SIEM/XDR platforms such as Microsoft Sentinel, Splunk, FortiSIEM, LogRhythm, or comparable technologies will also be considered.
Responsibilities:
Design, implement, configure, and optimize USM Anywhere SIEM/XDR environments.
Configure and manage security monitoring, log collection, data sources, integrations, agents, and supporting infrastructure.
Develop, tune, and maintain detections, correlation rules, alerts, dashboards, and other security monitoring capabilities.
Support threat detection, investigation, and incident response using SIEM and XDR technologies.
Leverage endpoint, network, cloud, application, and other security telemetry to improve threat visibility and detection.
Troubleshoot complex SIEM, XDR, security, infrastructure, and networking issues and serve as a technical escalation point for other engineers.
Support integrations between USM Anywhere and endpoint, cloud, network, identity, and other security technologies.
Develop automation and scripting to improve operational efficiency and enhance security response capabilities.
Identify opportunities to improve detection quality, system performance, reliability, scalability, and operational processes.
Support the architecture and deployment of new SIEM/XDR environments and customer solutions.
Create and maintain technical documentation, architecture diagrams, procedures, and operational standards.
Collaborate with Security Operations, Engineering, Service Delivery, and other technical teams to resolve complex customer and operational issues.
Participate in change management and CAB processes.
Stay current with emerging SIEM, XDR, threat detection, automation, and security operations technologies.
Qualifications for success:
5+ years of overall IT experience, including at least 2 years in cybersecurity engineering, security operations, or a related security role.
2+ years of hands-on experience implementing, administering, troubleshooting, or engineering SIEM and/or XDR solutions.
Strong hands-on experience with USM Anywhere or a comparable enterprise SIEM/XDR platform.
Strong understanding of SIEM concepts, including log collection, normalization, correlation, alerting, detection, dashboards, and security event analysis.
Experience developing, tuning, or troubleshooting security detections and understanding the underlying data supporting those detections.
Strong technical troubleshooting and advanced problem-solving skills.
Experience with security automation or scripting using PowerShell, Python, Bash, SQL, or similar technologies.
Foundational understanding of cloud security and infrastructure in AWS and/or Azure.
Working knowledge of networking concepts, including TCP/IP, DNS, VPNs, and IPsec.
Strong written and verbal communication skills.
- #LI-CS1
Preferred Qualifications:
Advanced experience with USM Anywhere and/or related LevelBlue security technologies.
Experience with Open XDR and security orchestration, automation, and response (SOAR) capabilities.
Experience with Microsoft Sentinel, SentinelOne, Splunk, FortiSIEM, LogRhythm, or other major SIEM/XDR platforms.
Experience working in an MSSP, managed security services, or professional services environment.
Experience supporting multiple customer environments or multitenant security platforms.
Strong Windows and Linux administration experience.
Experience with SQL, Elasticsearch, or other security data platforms.
Familiarity with MITRE ATT&CK and the NIST Cybersecurity Framework.
Relevant cybersecurity or vendor certifications.
Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field, or equivalent professional experience.
Skills Required
- Five years of overall IT experience
- At least two years of experience in a cybersecurity engineering role
- Five years of technical troubleshooting and advanced problem-solving experience
- Foundational understanding of cloud security best practices in Azure and AWS
- Knowledge of Elasticsearch and SQL, including query writing, maintenance, and migration
- At least two years of experience supporting and managing distributed LogRhythm deployments
- Expert-level knowledge of LogRhythm SIEM components
- Foundational understanding of LogRhythm detections and their underlying mechanisms
- Strong automation background in PowerShell, SQL, Bash, or Python
- Network administration experience, including IPsec tunnel troubleshooting and VPN creation
- Bachelor's degree in Computer Science, Information Security, Information Systems, or equivalent professional experience
- Strong understanding of Windows and Linux system administration
- Familiarity with SRE practices and principles
- Strong written and verbal communication skills
- Familiarity with CAB request, approval, and fulfillment practices
- Technical or professional security certifications such as LRPA, LRCA, LRSE, LRDE, CCNP, or SANS GIAC
- Familiarity with the MITRE ATT&CK Framework
What We Do
Avertium is the security partner that companies turn to for end-to-end cybersecurity solutions that attack the chaos of the cybersecurity landscape with context. By fusing together human expertise and a business-first mindset with the right combination of technology and threat intelligence, Avertium delivers a more comprehensive, more programmatic approach to cybersecurity – one that drives action on the ground and influence in the boardroom. That’s why over 1,200 mid-market and enterprise-level organizations across 15 industries turn to Avertium when they want to be more efficient, more effective, and more resilient when waging today’s cyber war. Show No Weakness® Avertium will focus its comprehensive expertise on supporting mid-to-large enterprises, making it one of the largest managed cybersecurity services companies focused on this market. Avertium is led by Jeff Schmidt, a security industry veteran, who has previously held executive leadership roles at a variety of successful technology and security companies, including International Network Services, All Covered, BT Counterpane, SQS, and Authomate. For more information and career opportunities, visit https://www.avertium.com/.
.png)
.png)
