Description
Xplor Technologies powers the experiences at the heart of everyday life. Through modern vertical software, embedded payments, and AI-powered capabilities, we help businesses in fitness, recreation, golf and club, field services, laundry, education, and other membership-based and service-based industries simplify operations, uncover insights, and elevate customer and member experiences.
Our Cyber Threat Intelligence & Response (CTIR) engineers are the people we count on when something goes wrong, and the people who make sure it goes wrong far less often. This is a hands-on incident response role. You'll lead the response to security events across our platforms and applications: triage, investigate, contain, eradicate and recover, then make sure we come out of it stronger.
Responsibilities:
- Own incidents as part of the CTIR team: detect, triage, investigate, contain and eradicate, driving each one until the threat is under control.
- Work live incidents alongside the team and be ready to step up and take the lead yourself when the situation calls for it.
- Lead investigations across our systems, digging into logs, endpoints, email and network data to work out what happened, how far it reached, and how to resolve.
- Perform host and network forensics, malware triage, and email analysis (including PDF and document analysis) to understand attacker activity and build a reliable timeline.
- Coordinate with engineering, IT and the wider security team during a response, and communicate clearly to both technical teams and leadership.
- Hunt proactively for threats across system logs, user behaviour and threat intelligence, turning what you find into new detections and indicators of compromise.
- Build and automate incident response workflows and playbooks so routine response is fast and repeatable.
- Strengthen our detection coverage using the MITRE ATT&CK framework, closing monitoring gaps, and tuning to reduce noise.
- Feed what you learn from each incident back into how the team detects and responds, so an attack pattern we've seen once is caught faster next time.
- Analyse threat intelligence, research emerging threats, and recommend practical mitigation.
- Be ready to work incidents as they arise, including on-call and out-of-hours cover when needed.
Qualifications:
- 3 to 6 years experience in security operations or incident response, with genuine passion for running incidents, not just watching a queue.
- Confidence managing incidents through the full incident-handling lifecycle, and the judgement to make sound calls under pressure.
- Strong triage and root cause analysis, with a solid understanding of different log sources and how to correlate events across them.
- Comfortable reading logs (HTTP, SMTP, network), Windows and Active Directory, and common operating systems and servers.
- Hands-on experience with a SIEM to investigate, hunt and build detections. Microsoft Sentinel and KQL preferred.
- Practical experience across EDR, advanced threat protection, identity management and API security.
- Threat-hunting experience across network flow, user behaviour and threat intelligence, plus the ability to design new ways to detect and contain attacks using scripting, analytics and automation.
- Familiar with a broad range of attacker tools and techniques (TTPs), with the ability to map adversary activity across the Cyber Kill Chain to identify, assess, and communicate potential attack progression.
- A self-starter who works independently, delivering projects without being chased, and keeps learning as the industry develops.
- A critical thinker with strong problem-solving instincts and exceptional communication skills, capable of translating complex technical risks into clear, actionable insights for both the immediate team and cross-functional partners, including engineers, administrators, and leadership, through both verbal and written communication.
- Good understanding of ITIL processes and standards such as ISO 27001 and PCI DSS, including change, incident and problem management.
Nice to have:
- Malware analysis experience.
- Preferred certifications such as GCIH, GCFA, AZ-500 or SC-100.
- Experience with Jupyter Notebooks for threat-hunting.
- Python and PowerShell scripting.
- Experience building and tuning SOAR automation for response.
Benefits:
- Paid Parental Leave benefit programs
- #GiveBackDays/Commitment to social impact – 3 extra days off to volunteer and give back to your local community
- Ongoing dedication to Diversity & Inclusion initiatives such as D&I Council, Global Mentorship Program
- Access to free mental health support
- Flexible working arrangements