Cybersecurity Operations Engineer II

Intelligent. Dynamic. Resilient. 

Everfox, formerly Forcepoint Federal, has been defending the world’s most critical data and networks against the most complex cyber threats imaginable for more than 25 years. As trailblazers in defense-grade, high assurance cyber security, we have been leading the way in developing and delivering innovative cyber security technology. We protect data wherever it resides. Our unwavering dedication and commitment to our customers and the critical missions they serve are what set us apart. We are dynamic, vigilant, and proactive in everything we do. Our suite of cross domain, threat protection and insider risk solutions empower governments and enterprise organizations to use data safely - where and however their people need it. At Everfox, we innovate, we invest, we achieve. We protect what matters most to our customers. And we offer protection like no other. We do all of this so our customers can focus on what matters most… their mission.

Title: Cybersecurity Operations Engineer II 

Location: Remote, USA

Job Summary:

The Cybersecurity Operations Engineer II plays a pivotal role in safeguarding the organization's digital assets by monitoring, detecting, and responding to security incidents and threats. This position requires a vigilant and detail-oriented professional with a strong understanding of security technologies, incident response, and a proactive approach to mitigating risks. 

Key Responsibilities: 

1. Security Monitoring and Incident Response: 

• Level 2/3 incident response, triage and investigation 

• Monitor and analyze security events using Security Information and Event Management (SIEM) and various security tools. 

• Investigate potential security incidents and escalate findings to senior security members. 

• Collaborate with cross-functional teams to develop and execute incident response plans. 

• Document incident details, actions taken, and lessons learned for continuous improvement. 

2. Threat Detection and Analysis: 

• Monitor and analyze network traffic, logs, and system events to identify patterns and anomalies indicative of security threats. 

• Stay current with emerging cyber threats and vulnerabilities and adjust monitoring and detection strategies accordingly. 

• Assist in the identification and coordination of appropriate teams to remediate security weaknesses or vulnerabilities. 

• Insider Threat/FIT analyst 

• Perimeter security administration and response 

3. Security Tool Management: 

• Level 2/3 CSP (Cybersecurity Engineering) - administration/monitoring of tools within M365 G5 

• Assist in the management and configuration of security tools such as SIEM (Security Information and Event Management), intrusion detection systems, and endpoint protection solutions. 

• Contribute to the tuning and optimization of security tools to reduce false positives and enhance detection accuracy. 

• Contribute to rule and detection tuning across security tools. 

• Monitor and respond to shared email boxes and leverage case management tools to triage, escalate, or resolve potential security incidents within SLAs. 

4. Compliance and Reporting: 

• Assist in maintaining compliance with security policies, procedures, and regulatory requirements. 

• Research and