{"id":3014484,"url":"https://alion.io/job/first-advantage-security-engineer","title":"Security Engineer","company":{"id":451841,"name":"First Advantage","domain":"fadv.sg","url":"https://alion.io/company/fadv-2","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":85,"open_postings":24,"ghost_share":0,"stale_share":0.542,"repost_share":0.125,"time_to_fill_p50_days":24,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"Platform Engineering","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SQL","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"Microsoft Defender for Cloud","optional":true},{"name":"Microsoft Sentinel","optional":true}],"status":"live","first_seen_at":"2026-10-21T16:15:44Z","employer_posted_date":"2026-10-21","last_verified_at":"2026-10-22T14:36:10Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"The Security Engineer is an intermediate technical individual contributor who investigates and resolves Level 2 and Level 3 SOC escalations, develops and tunes detections, builds approved automation, and contributes to SOC engineering projects. The role applies general knowledge of industry practices, techniques, standards, concepts, and principles to technical problems of moderate scope and complexity.\nKey Responsibilities\nInvestigate and resolve Level 2 and Level 3 alerts, cases, and incidents using established procedures, playbooks, and escalation paths.\nAnalyze endpoint, identity, email, cloud, network, and application telemetry to validate activity, determine scope, and document findings.\nDevelop, test, deploy, tune, and document detections for defined use cases across SIEM, XDR, EDR, cloud, identity, email, and other telemetry.\nDevelop approved enrichment, triage, notification, containment, and remediation workflows for Tier 1 scenarios that outsourced providers cannot fully address.\nPerform scoped threat hunts and retrospective searches using documented hypotheses and established analysis methods.\nSupport telemetry onboarding, platform configuration, integrations, and troubleshooting for assigned systems and use cases.\nMaintain accurate case records, detection documentation, automation runbooks, and technical procedures.\nContribute to project milestones and escalate work that exceeds established authority, procedures, or technical scope.\nMonitor and investigate security events generated from SaaS applications, PaaS platforms, APIs, web applications, and database services, and develop detections, enrichment logic, and response workflows to improve visibility into application-layer threats and unauthorized data access.\nCore Functional Responsibilities\nSOC Escalations and Incident Response: Handle both Level 2 and Level 3 escalations within established procedures; conduct evidence gathering, scoping, validation, containment, remediation, recovery support, and case documentation; engage senior responders when authority, impact, or complexity exceeds defined boundaries.\nDetection Engineering: Build and tune defined detections, queries, correlations, analytics rules, and incident logic; complete testing, peer review, deployment, regression validation, MITRE ATT&CK mapping, and documentation.\nTier 1 Automation: Address repeatable Tier 1 gaps that outsourced services cannot resolve by developing approved enrichment, triage, notification, containment, and remediation workflows.\nSOC Platform Engineering: Support Sentinel, Defender XDR, SOAR, telemetry connectors, case management, and related integrations; troubleshoot assigned platform, rule, data-quality, and automation issues.\nApplication Security Monitoring & Detection Engineering: Develop and maintain detections for suspicious application activity, administrative actions, privilege changes, API abuse, authentication anomalies, database access, and data-exfiltration indicators while validating telemetry quality and monitoring coverage.\nThreat Hunting and Analysis: Execute scoped hunts and retrospective searches using established hypotheses and methods; document findings and recommend detection or telemetry improvements.\nCollaboration and Documentation: Coordinate routine technical work with internal teams and service providers; maintain current cases, runbooks, detection documentation, and automation procedures.\nLeveling Alignment\nKnowledge and problem solving: Frequent use and general knowledge of industry practices; solves problems of moderate scope and complexity.\nDiscretion and latitude: Works under only very general supervision. Work is reviewed for soundness of judgment and overall adequacy and accuracy. Uses established policies and practices for guidance.\nOrganizational impact: Contributes to milestones associated with specific projects and operational goals. Errors may delay schedules or require additional resources to correct.\nInternal and external contacts: Primarily internal company contacts, with infrequent inter-organizational or outside contact on routine matters.\nRequired Qualifications\nGeneral knowledge of security operations, incident response, detection engineering, and common attacker techniques.\nHands-on experience with SIEM, EDR/XDR, SOAR, or comparable security technologies.\nExperience using KQL, SPL, SQL, or a comparable query language.\nFoundational experience with PowerShell, Python, APIs, or comparable automation technologies.\nAbility to document technical findings clearly and exercise sound escalation judgment.\nExperience investigating endpoint, identity, email, cloud, network, or application security activity and preserving clear evidence of analysis.\nWorking understanding of incident classification, escalation, containment, remediation, and recovery practices.\nAbility to use established engineering standards, peer review, source control, testing, and controlled deployment processes.\nAbility to balance concurrent incidents and engineering work, communicate status, and request guidance when scope or authority is exceeded.\nEducation and Experience\nBachelor + 2 years; Master + 0 years; PhD + 0 years; or equivalent. Relevant equivalent knowledge or work experience may be considered in accordance with the FA Technical Leveling definitions.\nPreferred Qualifications\nHands-on experience with Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Azure, AWS, or Microsoft 365.\nExperience working with an outsourced SOC, MDR, MSSP, or managed threat hunting provider.\nExperience creating security rules, playbooks, automation workflows, response actions, dashboards, or operational metrics.\nRelevant certifications such as SC-200, Security+, CySA+, AZ-500, or equivalent.\nMeasures of Success\nAccurate and timely resolution of assigned Level 2 and Level 3 escalations.\nReliable detections and automations delivered in accordance with team standards.\nReduction in repetitive Tier 1 escalations through approved playbooks and automation.\nComplete and usable case, detection, and workflow documentation.\nWe have great people here and are looking for more. Come join us!\nFraud Alert\nFirst Advantage does not charge candidates any fees at any stage of the recruitment process. We will never ask you to make a payment, purchase equipment, transfer money, or provide financial account information to obtain employment. If anyone claiming to represent First Advantage requests payment or other financial information, please treat the communication as suspicious and contact us through this website for verification.\nFollow us:\nFacebook\n\nInstagram\n\nLinkedIn\n\nX\n\nYouTube\n\nEqual Employment Opportunities at First Advantage\nFirst Advantage is an equal opportunity employer. We are committed to providing a workplace and recruitment process that is free from unlawful discrimination, harassment, and retaliation. Employment decisions at First Advantage are based solely on qualifications, merit, and business needs. We do not discriminate in any aspect of employment on the basis of race, color, national origin, ancestry, citizenship, religion, creed, sex, gender identity, gender expression, sexual orientation, marital or family status, pregnancy, age, physical or mental disability, medical condition, genetic information, veteran or military status, or any other characteristic protected by applicable law.","description_format":"text","description_chars":7436,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Human Resources"],"lifecycle":[{"event":"open","at":"2026-10-21T16:15:44Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":0,"expected_fill_days":24,"reasons":["conf:8","stale_co","velocity","win:early"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/first-advantage-security-engineer","json_url":"https://alion.io/job/first-advantage-security-engineer.json","meta":{"generated_at":"2026-10-22T15:49:59Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15761,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":451841},"rest":"https://alion.io/mcp/rest/get_company?id=451841"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffirst-advantage-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffirst-advantage-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffirst-advantage-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/first-advantage-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffirst-advantage-security-engineer"}]}