Internal security & security operations engineer

UltaHost is looking for a Senior Internal Security & Security Operations Engineer to take ownership of internal security and help strengthen the protection of our workforce, identities, systems, and day-to-day operations. This is a senior, hands-on technical role with responsibility across Identity & Access Management (IAM), internal security, security monitoring, SOC operations, and incident response.

• Design and maintain RBAC across departments, roles, and critical systems.
• Manage MFA, SSO, PAM, password vaults, API keys, SSH keys, recovery codes, and secrets.
• Own security controls around onboarding, role changes, temporary access, contractor access, and offboarding.
• Identify and remove shared, dormant, unnecessary, and excessively privileged accounts.
• Conduct regular access reviews and maintain approval and audit evidence.
• Monitor and investigate alerts from SIEM, EDR, IDS/IPS, authentication systems, cloud/SaaS platforms, internal applications, and endpoints.
• Investigate suspicious logins, compromised accounts, credential leaks, malware, privilege abuse, insider risk, and unauthorized access.
• Collect evidence, contain threats, coordinate recovery, and drive corrective actions through closure.
• Maintain detection rules, alert quality, incident records, escalation paths, and response playbooks.
• Lead internal security incidents and support infrastructure/product incidents involving identities or credentials.
• Define security requirements for laptops, VPN and remote access, email, code repositories, support platforms, finance tools, and administrative systems.
• Work closely with HR and IT on joiner/mover/leaver processes and internal security investigations.
• Support security awareness, phishing prevention, and secure handling of sensitive information and credentials.

• 5+ years of hands-on experience in internal security, IAM, SOC/security operations, incident response, IT security, or a closely related role.
• Practical experience with RBAC, MFA, SSO, PAM, identity providers, password management, account lifecycle management, and access auditing.
• Hands-on experience with SIEM, EDR, IDS/IPS, centralized logging, authentication logs, alert triage, and case management.
• Proven ability to investigate compromised accounts, malware, credential leaks, suspicious authentication activity, insider risk, and unauthorized access.
• Strong understanding of Linux access, SSH, VPN, endpoints, cloud/SaaS administration, email security, and remote-workforce security.
• Strong organizational skills and the ability to enforce security controls while collaborating with HR, IT, managers, and system owners.
• The successful candidate must have real hands-on experience administering access controls, operating security tooling, investigating logs, and responding to security incidents.
• Будет плюсом: Experience in web hosting, cloud infrastructure, data centers, SaaS, fintech, MSSP, or another distributed technology environment is highly valuable; Preferred certifications include Security+, CySA+, GCIH, SC-200, IAM/PAM vendor certifications, CISSP, or equivalent practical expertise; Certifications are a plus — hands-on experience matters more

• Условий в вакансии нет