Wursta
Wursta
51 – 200 Employees
ConsultingHealthcareLogistics
Wursta is a B2B technology consultancy helping organizations modernize how they work through AI, cloud, digital workplace, and cybersecurity services. Its work includes agentic AI adoption, Google Cloud architecture and managed services, Google Workspace and digital workplace migrations, bespoke application development, and compliance programs. Wursta also provides managed IT and virtual administrative support, training, and strategic advisory, connecting technology initiatives with practical business objectives.

Lead Security Operations Analyst at Wursta (Hybrid, Brazil)

Lead tier-three security operations, incident response, and AI-enabled automation for Wursta’s cloud, managed services, and cybersecurity operations. Engineer detections, integrations, and SOAR workflows across multi-tenant environments.

Description

  • Direct the triage, investigation, and prioritization of complex security events across client environments.
  • Act as Incident Commander for critical incidents, applying NIST SP 800-61r2 through containment, eradication, and recovery.
  • Lead threat hunting and detection engineering with MITRE ATT&CK, Sigma, and YARA.
  • Keep incident notifications and response activities within contractual SLAs and regulatory reporting deadlines.
  • Create production-ready Python, Node.js, or Go services that extend the MSSP application backend.
  • Develop integrations connecting EDR, DNS security, threat intelligence, phishing protection, identity, firewall, and IDS data.
  • Design SOAR playbooks that automate triage, identity enrichment, and tenant isolation.
  • Build LLM-based alert summarization and enrichment pipelines using Gemini, BigQuery SIEM data, REST webhooks, RAG, and MCP servers.
  • Improve detection workflows with machine-learning and AI filters that limit false positives.
  • Map security monitoring practices to NIST CSF 2.0, ISO/IEC 27001:2022, and NIST SP 800-53r5.
  • Maintain incident response and telemetry practices in line with GDPR, Brazil’s LGPD, and US state privacy laws.

Requirements

  • Hands-on experience with at least one SIEM or XDR platform, such as Splunk, Microsoft Sentinel, Elastic SIEM, CrowdStrike Falcon, SentinelOne, or Palo Alto Cortex XDR.
  • Experience using network and telemetry tools such as Wireshark, Zeek, Suricata, PCAP analysis, Syslog, Windows Event Logs, or CloudTrail and CloudWatch.
  • Practical experience with AI and automation technologies including Python, Pandas, Requests, REST APIs, Cursor IDE, GitHub Copilot, Claude or OpenAI APIs, LangChain, webhooks, or Docker.
  • Experience with SOAR and scripting tools such as Python, PowerShell, Bash, Demisto or Cortex XSOAR, Shuffle, or Tines.
  • Working knowledge of MITRE ATT&CK, NIST SP 800-61r2, the Cyber Kill Chain, YARA, or Sigma Rules.
  • Experience with AWS, Azure, or GCP security architectures, IAM, and cloud logging architectures.
  • Three or more years of experience in a SOC or MSSP environment is preferred.
  • Two or more years in a Level 3 or lead SOC role is preferred.
  • Hands-on scripting and API integration experience is preferred.
  • Experience with AI-assisted coding tools is preferred.
  • Expertise in endpoint, identity, network, and multi-cloud log analysis is preferred.
  • At least one of the following certifications is required: GCIH, GMON, GNFA, CySA+, CASP+, or OSCP.
  • Business-level fluency in English is required; applicants should have a strong command of the language.

Benefits

  • Autonomy, training, and the resources needed to address client challenges.
  • Access to professional training and development opportunities.
  • A hybrid working arrangement.
  • A positive culture centered on shared values.
  • Equal employment opportunity.

Related Jobs

Enlight Renewable Energy Ltd (ENLT)

Director of Engineering, Renewable Energy

Enlight Renewable Energy Ltd (ENLT)

Lead engineering for Enlight’s solar, wind, and battery storage projects, setting technical standards and guiding teams across the project lifecycle. The role covers optimization, due diligence, procurement support, and engineering leadership across Europe.

Open
General Dynamics Information Technology

Senior AI Autonomy Engineering SME, UAS and Drone Swarming

General Dynamics Information Technology

Lead the design of autonomous UAS, drone swarms, and command-and-control solutions for defense missions. Advance AI and machine learning capabilities across Department of Defense environments.

Open
UQ College

Administration Officer, UQ Biological Resources

UQ College
51 – 200 Employees
Education

Provide administrative support for UQ’s animal research operations at Long Pocket, including database maintenance, operational coordination and staff guidance.

Open