Cyber Threat Engineer – Global Threat Operations

About the role

LevelBlue is seeking a Cyber Threat Engineer to join its Threat Detection and Response (TDR) team within Managed Security Services. The role supports 24/7 monitoring and acts as the technical escalation point for complex security events, working closely with customers, partners, and the DFIR team.

Key responsibilities

• Analyze escalated, complex cases involving patterns of security events from endpoint detection and response technologies.
• Resolve technical problems within managed security solutions and drive continuous improvement projects.
• Create, improve, and document processes for managing and monitoring security solutions.
• Tune detection devices for blocking and reporting based on customer business needs.
• Baseline threat detection devices for complex or potentially breached environments.
• Test and refine endpoint detection, protection, and response policies.
• Provide timely responses to DFIR and client security teams during incident investigations.
• Perform rotating on‑call duties, including nights and weekends.
• Mentor analysts and serve as an escalation point within the TDR team.

Required profile

• Intermediate knowledge of cyber investigation, incident handling, and endpoint detection and response.
• Experience with Unix/Linux and Windows system administration.
• Strong analytical thinking, problem‑solving, and customer service skills.
• Self‑managed, team‑oriented, detail‑oriented, and highly motivated.

Required skills

• Advanced Palo Alto Cortex XDR
• Intrusion analysis
• Threat hunting and investigation
• Web services administration
• Log collection and analysis tools
• Current exploit and remediation techniques