Lead SecOps Engineer

About the Position

We are seeking a Lead SecOps Engineer to help protect our systems, applications, and data from evolving threats. You'll work at the intersection of security monitoring, incident response, and automation - building the detection and response capabilities that keep our environment secure.

Responsibilities

• Monitor security alerts and logs across endpoints, network, cloud, and applications (SIEM/SOAR platforms)
• Investigate and respond to security incidents, performing triage, containment, and root-cause analysis
• Develop and tune detection rules, correlation logic, and alerting to reduce false positives and close coverage gaps
• Build and maintain automation/playbooks for incident response (SOAR)
• Conduct vulnerability management, including scanning, prioritization, and coordinating remediation with engineering teams
• Perform threat hunting to proactively identify malicious activity
• Support security tooling deployment and integration (EDR, SIEM, cloud security posture tools, IAM)
• Participate in on-call rotation for security incidents
• Contribute to post-incident reviews and documentation (runbooks, RCAs)
• Collaborate with IT, DevOps, and engineering to harden infrastructure and enforce security best practices
• Assist with compliance/audit activities (SOC 2, ISO 27001, etc.) as needed

Requirements

• 5+ years of experience in security operations, incident response, or a related field
• At least 1 year of relevant leadership experience
• Hands-on expertise in SIEM (Splunk, Sentinel, Elastic, QRadar) and EDR tools
• Solid understanding of networking, operating systems (Linux/Windows), and cloud environments (AWS, Azure, GCP)
• Familiarity with common attack techniques and frameworks (MITRE ATT&CK, NIST Cybersecurity Framework)
• Scripting proficiency in Python, Bash, or PowerShell for automation and tooling
• Background in vulnerability management and remediation workflows
• Strong analytical and problem-solving skills; calm under pressure during incidents
• Clear written and verbal communication for documentation and cross-team collaboration (B2 English proficiency)

Nice to Have

• Experience with SOAR platforms (Palo Alto XSOAR, Tines)
• Security certifications (Security+, GCIH, GCIA, CISSP, OSCP)
• Background in threat intelligence or purple/red team collaboration
• Familiarity with container/Kubernetes security
• Experience in a regulated industry (finance)

We Offer

• Work on a flexible schedule remotely or from any of our comfortable offices or coworking spaces in Ukraine
• Receive the necessary equipment to perform your work tasks
• Change projects and technology stacks within EPAM
• Gain experience in various business domains (Insurance, E-commerce, Healthcare, Finance, Travelling, Media, Artificial Intelligence, and more)
• Relocation opportunities may be available for eligible candidates, depending on the role and openings at other EPAM locations
• Participate in volunteer, charity programs, and communities (both technical and interest-based)
• Focus on your professional growth:
  • Plan your individual career path together with your manager
  • Receive regular feedback from colleagues
  • Improve your English for free with certified teachers (Speaking Clubs, client interview preparation courses, etc.)
  • Get the opportunity to undergo free training and certification in AWS, GCP, or Azure Clouds
  • Use the internal E-learn training program (18,200+ specialized training and mentoring programs)
  • Access corporate accounts on LinkedIn Learning, Get Abstract, and other partner resources
  • Study at EPAM Solution Architecture School with practicing architects
  • Develop as a leader, join Delivery Management, Resource Management, Leadership Essentials school, and more
  • Participate in internal communities (500+ meetups, technical discussions, brainstorming sessions, online events, and conferences annually)

Vacation and Benefits

• Vacation and sick leave (including a sick leave without a medical certificate)
• A wide range of Voluntary Medical Insurance programs providing both medical treatment and various preventive options (including sports activities)
• Medical insurance for family members at corporate rates
• Company support during significant life events (childbirth or adoption, marriage, etc.)
• Support for psychological comfort: discounts on services from mental health specialists or coaches, thematic training
• E-kids program - a free programming language training program for EPAMers' children

About the Company

[Company description if present]