Cyber Defense Engineer

A front-line defender on BeyondTrust's Cyber Defense Operations team, protecting both the privileged access vendor's own corporate systems and the products its customers rely on. The engineer works alongside threat hunting, incident response and detection engineering colleagues, in a team that is moving toward an AI-augmented way of working.

The engineer triages alerts from SIEM, EDR and CSPM tools, investigates across identity, cloud and network logs, runs or leads incident response with forensics and reporting, turns threat intelligence into detection content mapped to MITRE ATT&CK, and helps build LLM-based triage workflows. On-call is part of it. BeyondTrust wants four or more years in a SOC or incident response role, SIEM query skills, EDR and cloud familiarity, and comfort using AI tools. Remote in the US or Canada.