Security Engineer – AWS Security Incident Response, Cloud Security, AI Security, EDR & SIEM

Summary of Position: Responsible for planning, managing, and implementing cybersecurity and IT compliance to ensure effective enterprise protection and innovation in the organization. We are looking for an intermediate-level Security Engineer who can support Alcon’s Cyber Incident Response and Threat Management function across AWS cloud security, SIEM monitoring, EDR/XDR operations, cloud incident response, and emerging AI security risks. This person should be hands-on, practical, and comfortable working with SOC, Cloud, Infrastructure, Identity, and application teams to improve threat detection, response, and security posture. Role Expectations: Monitor, investigate, and respond to security alerts across cloud, endpoint, identity, email, SaaS, and enterprise environments. Take ownership of assigned incidents from triage through containment, remediation support, documentation, and lessons learned. Work with internal teams and external SOC partners to ensure incidents are handled consistently and within defined operational expectations. Contribute to detection improvements, playbook maturity, operational documentation, and knowledge sharing across the SOC team. Key Responsibilities: 1. AWS Security Incident Response & Cloud Security Investigate AWS security alerts, suspicious activity, misconfigurations, and potential compromise scenarios using available cloud logs and security tooling. Review AWS security findings from services such as GuardDuty, Security Hub, CloudTrail, Config, IAM, CloudWatch, Inspector, and related monitoring sources. Support containment and remediation activities for cloud security incidents in coordination with Cloud Engineering and application owners. Identify gaps in cloud logging, monitoring, alerting, access control, and security posture, and recommend practical improvements. Assist in building and maintaining cloud incident response runbooks, investigation steps, and escalation procedures. Enhance incident detection and response capabilities for Cloud platforms. 2. SIEM Monitoring & Detection Engineering Work on Microsoft Sentinel and other SIEM-related monitoring activities to detect, investigate, and correlate threats across multiple data sources. Create, review, and tune SIEM use cases to improve alert quality and reduce false positives. Support onboarding and validation of important log sources including cloud, identity, endpoint, email, firewall, SaaS, and application logs. Develop dashboards, basic reporting, and operational metrics to improve visibility for SOC and leadership stakeholders. Map detections and investigation logic to common attacker behaviors using MITRE ATT&CK where applicable. 3. EDR / XDR Operations Investigate EDR/XDR alerts from platforms such as Microsoft Defender XDR and other endpoint security tools. Perform endpoint triage, device isolation support, IOC validation, malware investigation, and remediation coordination.