Docebo, the industry leader in cloud-based LMS, is looking for a skilled and highly motivated Cloud Security Engineer specializing in Security Incident Response to join our global Security Operations team.
As a Cloud Security Engineer, you will play a crucial role in identifying, containing, and mitigating cyber threats and incidents to ensure the security and integrity of Docebo's systems and data. You will be responsible for coordinating incident response activities and implementing strategies to improve incident detection and response capabilities.
You will work closely with different teams to validate, investigate, and respond to threats while continuously improving the overall incident response plan.
You will focus on automating all the phases of incident handling to timely thwart threats, reduce human error, and improve overall efficiency.
This position involves scheduled work times, including limited shifts on weekend days.
Reports To: Security Operations Manager
Location: Biassono or Milan, Italy (Hybrid)
Responsibilities:
- Manage and operate the installation and monitoring of security measures and tools to protect systems and information.
- Leverage SIEM solutions for security events identification and incident investigation.
- Respond to security incidents and conduct investigations, including documenting findings, analyzing root causes, and recommending corrective actions.
- Collaborate with different teams across the organization to validate, investigate, and respond to threats.
- Provide suggestions to improve detection capabilities, minimize false positives, and reduce manual investigation efforts.
- Partner with different business teams to identify, scope, create, and maintain scenario-based incident response playbooks.
- Analyze signals and logs across our diverse environments to detect potential adversarial techniques against our infrastructure.
- Define, create, and tune detection rules to detect malicious or unauthorized activity.
- Leverage automation tools to promptly address cyber threats and decrease time to remediation.
- Maintain documentation and data of past incidents to measure the effectiveness of the incident response plan.
- Keep updated on the latest trends, tools, and techniques in incident response and cyber security.
- Other duties related to Information and Cyber Security as may be assigned or requested.
Requirements:
- Fluency in English.
- Good knowledge of cloud architecture.
- Experience in incident handling and response.
- Experience with SIEM tools.
- Strong knowledge of information security principles and best practices.
- Experience in defending against threats on hybrid networks.
- Experience with code scripting (e.g. Python, Bash) and security automation tools.
- Experience in using and interpreting cyber security frameworks (e.g. MITRE ATT&CK, NIST SP 800-53, CIS, PCI, SOC 2, ISO 27001).
Nice to have:
- Security-related certification, such as from ISC2, ISACA, SANS, or CompTIA.
- AWS certifications.
- Experience with Cloud Security tools (CSPM, CWPP, CIEM, CNAPP, IaC).
- Experience in operationalizing the MITRE ATT&CK framework.
- Familiarity with Okta IAM.
- Knowledge of CIS Controls.
- Knowledge of endpoint and email security solutions.
- Familiarity with DevSecOps practices.
