Cybersecurity Engineer
About the role
Key responsibilities
- Security monitoring and response
- Monitor security alerts and events using SOC tools (SIEM, IDS/IPS, DLP, EDR) and escalate validated incidents.
- Triage, investigate, and document potential security incidents; prioritize response actions based on risk.
- Maintain and tune detection rules, correlation logic, and alert thresholds to reduce false positives and improve detection fidelity.
- Incident management and coordination
- Oversee end-to-end management of security incidents: detection, containment, eradication, recovery, and post-incident activities.
- Coordinate cross-functional response with IT, engineering, legal, and business stakeholders during incidents.
- Lead post-incident reviews: capture lessons learned, track root cause analysis, and ensure corrective actions are implemented.
- Red team leadership and exercises
- Supervise and lead all red team exercise activities, including internal exercises and engagements with third-party vendors.
- Plan, scope, and execute offensive security exercises to test controls, detection capability, and response readiness.
- Mentor and manage red team members within the security team; review findings and translate them into remediation and detection improvements.
- Policy, guidelines, and continuous improvement
- Formulate, review, and maintain specific security guidelines, operational playbooks, and SOC standard operating procedures.
- Contribute to security program improvements by recommending controls, detection enhancements, and process changes informed by incidents and exercises.
- Malware analysis and threat validation
- Conduct initial malware analysis using automated tooling and sandbox environments to determine behavior, impact, and IOCs (indicators of compromise).




- Enrich incident investigations with threat intelligence and produce actionable findings for containment and remediation.
- Tooling and operational expertise
- Operate and optimize SOC monitoring tools — SIEM, IDS/IPS, DLP, EDR, and related platforms.
- Create and maintain detection content (correlation rules, parsers, dashboards) and support integration of telemetry sources.
**Qualifications**:
- Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent experience.
- Advanced English
- 3+ years of hands-on SOC or incident response experience; demonstrated experience leading incident response activities.
- Experience leading or participating in red team/penetration exercises and working with third-party offensive teams.
- Familiarity with SIEM, IDS/IPS, DLP, EDR platforms and log/telemetry collection and analysis.
- Basic malware analysis skills, including use of automated sandboxing and static/dynamic toolkits.
- Strong understanding of network protocols, OS internals (Windows, Linux), common attack techniques, and defensive controls.
- Excellent written and verbal communication; ability to create clear incident reports, playbooks, and policy documents.
- Relevant certifications a plus: e.g., CISSP, GCIA, GCIH, GREM, OSCP, CEH, or equivalent.
Key competencies
- Analytical thinking and attention to detail.
- Effective leadership and mentorship skills.
- Strong incident management and crisis coordination abilities.
- Problem-solving mindset and commitment to continuous learning.
What we offer
- Competitive salary and benefits
- Opportunities for professional development and certification support
- A collaborative and security-focused work environment
- Exposure to advanced detection and red teaming activities, with direct impact on organizational security posture
Sueldo: $30,000.00 - $40,000.00 al mes
Beneficios:
- Confiable de vida
- Vales de despensa
Lugar de trabajo: Empleo presencial

📌 Cybersecurity Engineer (Ciudad Juárez)
🏢 Wistron México
📍 Ciudad Juárez