Senior Information Security Engineer
About the role
The Senior Information Security Engineer is a senior technical and leadership role within the global Security Operations Center (SOC) at IFS. This position is responsible for advanced threat detection, deep-dive investigation, and major cyber incident response across a fast-growing, global SaaS business. The role combines hands-on operational work with leading SOC capability-building and transformation initiatives, including detection engineering, automation, and analyst tooling. The engineer acts as the senior escalation point for high-priority incidents, mentors Tier 1/2 analysts, and works to uncover and close gaps in the organization's defensive posture. Key responsibilities include leading incident response, performing forensic analysis, developing SOC capabilities, engineering threat detection, conducting threat hunts, enabling automation, supporting vulnerability management, maintaining documentation, mentoring team members, and contributing to governance and tooling strategy.
Must have
- 5+ years of experience within a Security Operations Center (SOC) or Cyber Defense function, including demonstrable experience operating within a fast-growth or rapidly scaling organization.
- Proven track record of developing SOC capability and delivering SOC transformation or maturity programs (e.g. detection engineering, automation, process redesign, tooling consolidation).
- Hands-on experience leading major or high-priority cyber incident response, from initial triage through to executive-level post-incident reporting.
- Strong hands-on expertise with SIEM (preferably Microsoft Sentinel), EDR (e.g. Microsoft Defender for Endpoint) and SOAR platforms.
- Advanced analytical and investigative mindset, with a genuine, demonstrable curiosity for understanding root cause and emerging threat techniques.
- Strong forensics and security analysis skills, with the ability to make sound, well-informed decisions with minimal supervision under pressure.
- Excellent written and verbal communication skills, including the ability to brief non-technical and executive stakeholders during live incidents.
- Degree in Cyber Security, Information Technology, Computer Science or a related field, or equivalent demonstrable experience.
Nice to have
- Experience with SOC automation, AI-enhanced detection and response, KQL analysis, scripting or Python.
- Exposure to threat intelligence platforms and structured frameworks such as MITRE ATT&CK.
- Familiarity with cloud security (Azure/AWS) and modern cyber defense methodologies.
- Experience mentoring or leading junior analysts within a SOC environment.
Technologies
- AWS
- Azure
- Cloud Security
- EDR
- IFS
- MITRE ATT&CK
- Python
- SaaS
- Microsoft Sentinel
- SIEM
- Threat Hunting
- Vulnerability Scanning
Highlights
The role reports to the SOC Manager and is central to the ongoing transformation and maturity uplift of the SOC function. The position is suited for someone who has thrived in fast-growth organizations and is comfortable building processes and capabilities from a lower level of maturity. The company is a global SaaS business. No specific location, remote, or visa requirements are mentioned.
Jobs across Sri Lanka, watched for you.Colombo, Sri Lanka