Area Lead - Security Engineering

Area Lead owns the security operations, vulnerability management, identity governance, and NIS2 compliance posture for the managed infrastructure estate.

Responsibilities

• Own end-to-end security service delivery: SIEM monitoring, alert triage, vulnerability scanning, patch compliance tracking, endpoint protection, and identity/access governance
• Hold EPAM's NIS2 compliance sign-off chain for managed infrastructure — own audit evidence and regulatory reporting
• Lead security transition-in: tooling onboarding, runbook authorship, current-state risk assessment, and knowledge transfer from incumbent vendors
• Govern a team of 6 offshore security engineers across operations, incident response, and change security reviews
• Interface directly with the client's CISO team and retained SOC function
• Drive security posture improvement — KPIs, metrics, and continuous improvement cycles
• Manage security incidents through the escalation chain to the client

Requirements

• 7+ years in security engineering or SOC operations
• Microsoft Sentinel — SIEM administration, detection rule authoring, alert triage
• Microsoft Defender — EDR management and policy governance
• Tanium — endpoint visibility and remediation
• Tenable — vulnerability scanning, prioritisation, and reporting
• Microsoft Entra ID — PIM, conditional access, identity governance
• CyberArk — PAM vault operations and onboarding
• CyberArk EPM — shadow IT and endpoint privilege management
• Palo Alto Cortex / Prisma — cloud security posture (migration from Prisma to Cortex in progress)
• NIS2 Directive — working knowledge of compliance requirements and evidence chains
• MSP or outsourcing background — experience governing remote delivery teams
• English — fluent; German or Czech — strong asset

Nice to have

• CISSP, CISM, or equivalent
• Microsoft SC-200 (Security Operations Analyst)