Cql Engineer Jobs

1 job found

1d ago

Information Security Engineer – Security Automation and Response

UChicago Medicine Round Lake, IL 🇺🇸 Remote

Round Lake, IL

1d ago

Full time Cql Cybersecurity Tools Incident Response

Apply Now

Job Description

This remote position supports UChicago Medicine's Information Security team as an Information Security Engineer focused on Security Automation and Response. The role centers on designing and maintaining SOAR playbooks, automating security tasks, and assisting with incident response and threat investigations.

Overview

The role operates within the Information Security department, delivering automation and guidance to enhance security operations from a remote location in Illinois.

Responsibilities

Create, deploy, and maintain SOAR playbooks to streamline routine security tasks such as alert triage, threat analysis, and incident response, leveraging SOAR platforms, Python scripting, and API integrations.
Apply knowledge of threat detection development, automate SOAR development, and support incident response processes.
Collaborate with the Information Security Operations Manager to advance Security Operations capabilities with AI technologies.
Conduct investigations into malware, intrusions, unauthorized access, and data infiltration and exfiltration events.
Examine logs, memory dumps, disk images, and network captures to determine attack scope and impact.
Stay current on cyber threats and standard SOC practices to continually improve security operations.
Demonstrate strong knowledge of security information and event management platforms and associated query languages such as Yara-L, CQL, and SPL.
Participate in Purple Team activities.
Join on-call rotations and respond to critical security events.

Essential Job Functions

Develop, implement, and maintain SOAR playbooks to automate repetitive security tasks using SOAR tools, Python, and API integrations.
Apply expertise in threat detection development, SOAR automation, and incident response.
Support initiatives with the Information Security Operations Manager to enhance Security Operations capabilities through AI.
Investigate malware, intrusions, unauthorized access, and data infiltration and exfiltration events.
Analyze logs, memory, disk images, and network captures to assess attack scope and impact.
Maintain current awareness of cyber threats and standard operating procedures to improve SOC capabilities.
Utilize SIEM platforms and query languages such as Yara-L, CQL, and SPL with proficiency.
Engage in Purple Team activities.
Participate in on-call rotation and respond to critical security events.

Requirements

Bachelor's degree in Computer Science, Engineering, or an equivalent combination of education, training, and experience.
Minimum five years of security experience or equivalent background.
Understanding of computing systems, data network communications, and network architecture.
Strong written and verbal communication skills.
Experience in SOAR playbook development.
Proficiency in scripting or programming languages such as Python, PowerShell, or Go.
Experience in incident response and threat investigations.
Experience in threat detection.
Understanding of logging systems.
Security certifications are preferred (GIAC, CISSP).

Technologies

SOAR
Python
API integrations
Yara-L
CQL
SPL
PowerShell
Go
SIEM

Position Details

Job Type/FTE: Full Time (1.0 FTE)
Shift: Day
Location: Remote
Unit/Department: Information Security
CBA Code: Non-Union

View full job page →

Get Cql Engineer Jobs alerts

New Cql Engineer Jobs, daily.