Security Operations (SecOps) Engineer

Samsung SDS America (SDSA) serves as the U.S. technology and innovation hub for Samsung’s global enterprise solutions, delivering secure, scalable, and high‑performance IT services that support some of the world’s most complex business environments. As SDSA continues to expand its cloud, mobility, analytics, and cybersecurity capabilities, maintaining a resilient security operations foundation is essential to protecting the company’s digital assets and ensuring uninterrupted service delivery. This need for operational rigor and real‑time threat defense creates the environment in which the Security Operations Engineer plays a critical role.

The Security Operations Engineer is responsible for three core operational pillars: daily security operations management, real‑time threat detection and incident response, and security control governance and optimization. The role oversees the day‑to‑day execution, ensuring the integrity, confidentiality, and availability of enterprise systems by actively monitoring networks through SIEM, DLP, and secure web gateway technologies. The engineer leads the full incident response lifecycle—validating alerts, coordinating escalation paths, conducting forensic investigations to determine root cause, and executing targeted remediation to prevent recurrence.

Responsibilities:

• Manage daily functions of security operations, while protecting the integrity, confidentiality and availability of information technology resources.
• Administer network and computer system level security controls that help enforce policies and procedures.
• Ability to create standard procedures/run books for managing and maintaining various security controls.
• Coordinate and administer maintenance and upkeep of security-related control systems, including anti-virus, firewalls, intrusion prevention systems, secure web gateway etc.
• Ensure appropriate incident response procedures and processes exist, including identifying and establishing appropriate escalation/communication chain.
• Carry out forensic investigations to root cause security incidents/breaches and carry out effective remediation activities.
• Daily monitoring of enterprise networks using security controls such as SIEM, DLP and secure Web Gateway and coordinate incident response activities based on the events and alerts generated by security controls.
• Work closely with Security engineering team in instituting an effective Threat & Vulnerability Management program.
• Assist in reviewing existing security controls and help identify security risks.
• Work closely with security architecture team in recommending effective security controls to mitigate and minimize security risks.
• Create and maintain security operations dashboard, showing risk areas and common threats.

Requirements

• 4+ years' experience directly related to information technology security in medium to large enterprise.
• Demonstrated experience with network and IT security components, including firewalls, intrusion detection systems, anti-malware software, data encryption, VPN, vulnerability scanners, server operating systems, and other industry-standard techniques and practices.
• Demonstrated ability to perform penetration testing (system, network, application) and security control configuration review to identify gaps and develop effective remediation strategies to address the gaps.
• Demonstrated ability to develop metrics, performs critical analysis, and develops executive decision support content.
• Excellent communication skills with the ability to write documents ranging from formal and informal reports, system documentation, and training materials.
• Experience in project management and change management procedures and techniques.
• Experience managing information security controls, specifically monitoring, troubleshooting, maintaining, and modernization of mission critical networks and information systems.
• Must be familiar with a wide range of security technologies including, but not limited to: SIEM, IDS/IPS, malware analysis and protection, content filtering, logical access controls, identity and access management, data loss prevention, content filtering technologies, application firewalls, vulnerability scanners, LDAP, forensics software, security incident response and Identity Management.

• Must be willing and able to work onsite in San Jose, CA.

Preferred Qualifications:

• Experience with project management, vendor management, and policy development.
• Prior experience in leading or being part of a security incident response team and proven experience in using SIEM and network DLP.
• Ability to work in a small, collaborative team environment and as an individual contributor.
• Bachelor’s Degree in re