L3 Security Operations Specialist (Onsite)

Job Description We are looking for an L3 Security Operations Specialist to join our cybersecurity operations team. In this role, you will handle complex technical escalations related to SIEM, EDR, NDR and XDR platforms. You will investigate security incidents, troubleshoot product and integration issues, improve detection rules, and support customers and internal teams during critical cases. Key Responsibilities Handle L3 escalations related to SIEM, EDR, NDR and XDR platforms Investigate security events and identify the root cause of technical issues Troubleshoot product configuration, integration, correlation and alerting problems Create, test and maintain detection rules and correlation use cases Map detection rules to the MITRE ATT&CK framework and Cyber Kill Chain Review false positives and improve alert quality Support Incident Response and DFIR activities Perform threat hunting and document findings Analyse suspicious files, behaviours and malware-related events Support security products such as firewalls, WAF, IDS and IPS Work with vendors during advanced technical escalations Communicate with customers during high-priority incidents Prepare root cause analysis documents, technical reports and runbooks Work closely with SOC, Threat Intelligence, Infrastructure and Security teams Provide technical guidance to L1 and L2 support teams Requirements At least 2 years of experience in cybersecurity operations, SOC, security product support or Incident Response Hands-on experience with at least one SIEM platform, such as IBM QRadar, Logsign or Graylog Experience with EDR, NDR or XDR technologies Experience in security event analysis and incident investigation Good knowledge of detection rules, correlation use cases and false positive analysis Knowledge of MITRE ATT&CK and Cyber Kill Chain Working knowledge of Windows and Linux operating systems Knowledge of networking concepts, firewalls, WAF, IDS and IPS Experience with customer-facing technical support or escalation management Strong documentation and reporting skills Ability to analyse complex technical issues and provide clear solutions Ability to read technical documentation and communicate in English Preferred Qualifications Experience with Cortex XDR, Carbon Black, Microsoft 365 Defender, Vectra or Attivo Experience with SOAR platforms Knowledge of malware analysis or digital forensics Experience with threat hunting Basic scripting knowledge in Python, PowerShell or Bash Experience in a 24/7 SOC or shift-based security operation Fortinet or Cisco experience Relevant certifications such as Fortinet NSE, Cisco Security or other cybersecurity certifications If you enjoy incident investigation, technical troubleshooting and helping teams respond to real-world threats, we’d like to hear from you. Amaris Consulting is committed to promoting diversity within its workforce and to creating an inclusive work environment. We review applications from all qualified individuals regardless of gender, sexual orientation, race, ethnicity, beliefs, age, marital status, disability, or any other characteristic. Special consideration will be given to candidates with disabilities.