Cyber Security Engineer

Astellas’ Global Capability Centers Overview

Purpose And Scope

Responsibilities

• Support daily SOC operations, ensuring effective monitoring support, development of use cases and response to security incidents.
• Manage application ingestion processes and email security protocols.
• Support SIEM management, including logging and alerting.
  

Automation Development

• Develop and implement automation solutions for alerts from various security sources, ensure firewalls, IDS and EDR tools are working effectively.
• Streamline processes to enhance the efficiency of security operations and help develop communication with other teams.
  

Threat Modelling

• Conduct threat modelling for applications to identify vulnerabilities and recommend mitigation strategies.
• Analyze email tickets and develop tooling to improve response times and effectiveness.
• Provide root cause analysis for the threat found and assist with remediation.
  

Anti-Malware And Endpoint Detection

• Assist in operational efforts to implement a global strategy for anti-virus (AV) solutions and optimize detection capabilities.
• Ensure consistent standards for endpoint detection and response across the organization.
  

Incident Response

• Lead or support incident response efforts using an industry-recognized model and report escalations to senior leadership when required.
• Collaborate with Red, Blue, and Purple teams to conduct penetration testing and improve security posture.
• Conduct forensic analysis to investigate security incidents and recommend improvements.
  

Proactive Threat Hunting

• Engage in proactive threat hunting to identify potential security threats before they materialize.
• Collaborate with teams to enhance detection and response capabilities.
  

Reporting And Data Analysis

• Engage in proactive collaboration across Value Teams, working with an agile mindset, and assist in the creation of dashboards and reporting for security governance.
• Assist in the governance of security within cloud infrastructure.
  

Required

• Bachelor’s degree in Computer Science, Information Technology, Cyber Security, or a related field.
• Proven experience in a cybersecurity role, preferably within a SOC/SIEM/SOAR environment.
• Experience in using Microsoft Sentinel & Defender / Crowdstrike EDR / Wizz Cloud Security.
• Strong knowledge of security frameworks, threat modelling, and incident response methodologies.
• Awareness of infrastructure and network security features like firewall rules, event IDs, logging/detection, and managing assets in manufacturing / OT environments.
• Experience of working with cloud security and insourced capabilities, as well as MSPs.
• Experience with SIEM/Cloud security tools and automation technologies.Familiarity with anti-malware solutions and endpoint detection strategies.Proficiency in scripting languages for automation (e.g., Python, PowerShell) is an advantage.
• Experience in digital forensics (log analysis and technical root cause assessment).
  

Preferred

• Security certification is an advantage.
• Demonstrate knowledge of change management principles. Relevant certifications (e.g., Certified Information Systems Security Professional CISSP, Certified Ethical Hacker CEH or CompTIA Security+, etc.)Excellent analytical and problem-solving skills.
• Strong communication skills and the ability to work collaboratively in a small team environment where we share capacity and effort.
• International/global experience is an advantage.