Senior Security Engineer – Detection & Incident Response

About the role

Everpure is looking for a hands‑on Senior Security Engineer to lead detection engineering, threat hunting and incident response from its Prague office. You will work closely with global SOC teams to build high‑quality detections, automate workflows and respond to complex security incidents.

Key responsibilities

• Design, implement and maintain detections in Splunk and related platforms using detection‑as‑code (YAML/JSON), unit testing and MITRE ATT&CK mapping.
• Investigate suspicious activity, lead incident triage, containment, eradication, recovery and post‑incident reviews.
• Execute hypothesis‑driven threat hunts across endpoint, cloud, identity, SaaS and network telemetry.
• Continuously tune detections to improve true‑positive rates and reduce alert fatigue.
• Operationalize cyber threat intelligence and translate it into detection and hunting strategies.
• Develop Python scripts, API integrations and SOAR playbooks (Tines, XSOAR, etc.) to automate investigation and response.
• Monitor cloud environments (AWS, GCP, Azure) and container/Kubernetes runtimes for security anomalies.
• Evaluate and implement AI‑assisted security workflows while maintaining human oversight.

Required profile

• 6+ years of experience in cybersecurity, incident response, detection engineering or related fields.
• 3+ years of hands‑on threat hunting or complex incident investigation in a SOC/SIEM environment.
• Deep expertise with Splunk (searches, dashboards, alerts, forwarder management).
• Strong knowledge of networking, operating systems, cloud architectures and security across identity, endpoint, network and cloud.
• Excellent written and verbal communication skills in English.

Required skills

• Splunk (search, dashboards, alerts, correlation searches)
• Python scripting for data processing and automation
• Detection‑as‑code formats (YAML, JSON, Sigma, YARA‑L)
• MITRE ATT&CK framework and threat intelligence integration
• SOAR platforms (Tines, XSOAR, Splunk SOAR)
• Cloud security monitoring (AWS, GCP, Azure, CloudTrail, GuardDuty)
• Container and Kubernetes security tools (e.g., Falco)
• AI/LLM‑assisted investigation concepts