EPAM is seeking a talented security engineer experienced in Cyber / Information / Network / Cloud Security in Enterprise environments, with decent scale knowledge of SIEM and SOAR technologies. The ideal candidate should have a background working within an Enterprise SOC with proven hands-on experience in SIEM and SOAR configuration to enable detection of security events and incidents response. SOC Engineer will be a part of a SIEM engineering practice focused on migration projects for our customers.
This position offers hybrid setup with the flexibility to work from any location in Lithuania, whether it's your home or our dynamic offices in Vilnius and Kaunas.

#LI-DNI#top-vacancies-10-LT-dec

Responsibilities

• SIEM & SOAR Configuration: Configure SIEM and SOAR solutions, ensuring seamless integration with various security tools, systems, and data sources. Conduct SIEM and SOAR testing and validation
• Use Cases Development & Implementation: Develop detection use-cases and implement SIEM detection rules. Develop SOAR remediation use-cases. Create, test, and update SOAR playbooks to streamline security operations
• Log Sources Integration & Threat Hunting: Integrate log sources with SIEM, optimize log ingestion and processing. Perform threat hunting, data enrichment, threat intelligence feeds onboarding, and utilize them for automated responses
• Documentation & Reporting: Generate reports for both technical and non-technical staff and stakeholders
• Relentless Improvement: Stay up-to-date with SIEM technologies and identify opportunities for continuous improvement

• At least 2 years experience with 1 or more SIEM solutions (Azure Sentinel, Splunk, Google SecOps, QRadar, ArcSight, etc.)
• Basic knowledge of at least 1 cloud platform (GCP, Azure)
• Basic understanding of Windows, Linux, DB, network device monitoring and logging techniques
• Technical knowledge of Internet security, Network protocols, and related technologies, including IDS/IPS, firewalls, content filtering, Network Behaviour Analysis tools, Anti-malware and packet inspection
• Basic understanding of host and network security hardening, and common security risk management concepts

• Proficiency in scripting and automation (e.g., Python, PowerShell), developing API integrations with SIEM/SOAR
• Familiarity with attack frameworks and knowledge bases, such as the MITRE ATT&CK framework, CAPEC, etc
• Experience with leveraging AI assistance in daily security operations
• Experience with 1 or more SIRP/SOAR tool (Google SecOps SOAR, TheHive, Cortex, Splunk Phantom, Demisto/XSOAR, Resilient etc.)
• Knowledge of Splunk Search Processing Language (SPL), Splunk Common Information Model (CIM), YARA-L 2.0, Unified Data Model (UDM), Kusto Query Language (KQL)

• Engineering Heritage: Best-in-class experts sharing a culture of engineering excellence and tackling complex engineering challenges for over 30 years
• Advanced Tech Stack: Innovative projects where you can apply or enhance your expertise in Cloud, Data, AI, and other emerging technologies
• World-Class Clients: Work closely with 295+ of the Forbes Global 2000 on creating disruptive solutions that make a global impact
• Professional Growth: Exceptional support for career development with comprehensive resources for upskilling or reskilling in pioneering practices
• GenAI Community: Strong AI competencies with 600+ experts across 55+ locations driving GenAI-enabled transformation journeys
• Entrepreneurial Culture: If you're passionate and dedicated to improving business transformation, we provide the support you need to bring your ideas to life
• Hybrid Setup: The flexibility to work from any location in Lithuania, whether it's your home or our dynamic offices in Vilnius and Kaunas
• Other Benefits: Additional vacation and trust days, private health insurance, Employee Stock Purchase Plan and more