Security Operations Engineer at Revizto in Revizto R&D

Job description

Revizto enables the people behind the world’s most important structures to do their best work. We connect architects, engineers, contractors, and owners in one shared 2D/3D environment to help deliver complex projects on time and on budget. From airports and hospitals to data centers and large-scale infrastructure, Revizto supports industry leaders in reducing risk, improving collaboration, and delivering better project outcomes. Built on a gaming engine, Revizto is designed to handle the scale and complexity of modern construction projects while remaining fast, reliable, and accessible across devices and environments — whether teams are in the office or on site. Key Responsibilities & Requirements Security Monitoring & Investigation: Monitor, triage, and investigate security alerts and incidents across cloud, endpoint, and SaaS environments, ensuring timely identification and assessment of potential threats. Incident Response Management: Lead and coordinate security incident response activities, including containment, eradication, recovery, root-cause analysis, and preparation of comprehensive post-incident reports. Threat Detection Engineering: Develop, test, and continuously refine security detection rules to improve accuracy, reduce false positives, and maintain detection coverage aligned with the MITRE ATT&CK framework. Proactive Threat Hunting: Conduct proactive threat-hunting activities across cloud, endpoint, and identity telemetry to identify suspicious behavior, emerging threats, and potential security compromises. Security Log Analysis: Analyze and correlate security logs and telemetry from AWS, Microsoft Azure/Entra ID, Kubernetes, endpoints, and SaaS applications to detect and investigate potential security incidents. Cloud Security & Vulnerability Management: Investigate cloud security findings and vulnerability alerts, collaborate with relevant system owners, and support timely remediation of identified security risks. Security Logging & Visibility: Maintain the health, completeness, and reliability of existing security log sources while identifying and onboarding additional sources to improve monitoring and detection coverage. Incident Response Documentation: Develop, maintain, and continuously improve incident response runbooks and escalation procedures to ensure consistent and effective handling of security events. Requirements Professional Experience: At least 3 years of hands-on experience in a Security Operations Center (SOC), incident response, or security detection role. SIEM & EDR Technologies: Practical experience working with Security Information and Event Management (SIEM) solutions, preferably Microsoft Sentinel, and Endpoint Detection and Response (EDR) platforms, preferably CrowdStrike Falcon. Detection Engineering & Query Languages: Ability to write, analyze, optimize, and tune security detection queries using Kusto Query Language (KQL) or similar query languages. Cybersecurity Fundamentals: Solid understanding of common cyberattack techniques, threat behaviors, and the MITRE ATT&CK framework, combined with a strong foundation in AWS and Azure cloud security principles. End-to-End Incident Response: Proven experience managing security incidents throughout their entire lifecycle, from initial alert investigation and triage through containment, eradication, recovery, root-cause analysis, and post-incident reporting. Security Frameworks & Standards: Knowledge of established information security frameworks and standards, including ISO 27001, NIST, CIS, and SOC 2. English Proficiency: Upper-intermediate (B2) or higher proficiency in English, both written and spoken. Preferred Qualifications Hands-on experience conducting proactive threat-hunting activities to identify and investigate potential security threats. Knowledge of Kubernetes and container security principles, including common risks and security considerations in containerized environments. Basic scripting skills in Python, PowerShell, or Bas