Xây dựng hệ thống giám sát, phát hiện và tự động hóa bảo mật ứng dụng AI LLM và MCP tại Qualgo Technologies.
Yêu cầu
Tốt nghiệp đại học ngành CNTT, Khoa học máy tính, An toàn thông tin hoặc liên quan
Tối thiểu 3 năm kinh nghiệm an ninh mạng, tập trung vào SOC, SIEM, bảo mật endpoint
Kinh nghiệm triển khai và quản trị ít nhất một nền tảng SIEM lớn
Kinh nghiệm với Python, SQL, tích hợp công cụ bảo mật qua API và tự động hóa
Hiểu biết về Kafka, ClickHouse, S3, Apache Flink, MITRE ATT&CK và D3FEND
Trách nhiệm
Phát triển thu thập, chuẩn hóa và làm giàu dữ liệu bảo mật từ endpoint, network, cloud
Xử lý dữ liệu bảo mật với Kafka, ClickHouse, S3, Apache Flink cùng backend
Phát triển, tối ưu rule phát hiện, logic tương quan và quy trình điều tra theo SIEM
Xây dựng tự động hóa bảo mật qua backend, API, AI LLMs và MCP
Có thì tốt
Chứng chỉ CompTIA Security+, CySA+ hoặc CASP+
Chứng chỉ GIAC (GCIH, GCIA, GSEC) hoặc CISSP
Tóm tắt bằng AI từ JD gốc, đọc JD gốc trước khi ứng tuyển.
Job description
Qualgo Technologies is seeking a skilled and motivated Cybersecurity Analyst to join our team in building a cybersecurity ecosystem that addresses critical security needs and helps SMEs, businesses, and individuals stay safe online.
You will develop security monitoring, detection, and automation capabilities across our ecosystem, powered by a dedicated backend, AI LLMs, and Model Context Protocol (MCP) integrations.
Key responsibilities
Develop security data collection, parsing, normalization, and enrichment mechanisms across endpoint, network, cloud, and application sources.
Consume and process security data using Kafka, ClickHouse, S3, and Apache Flink in collaboration with backend engineers.
Develop and optimize detection rules, correlation logic, and investigation workflows based on SIEM concepts.
Build security automation through backend services, APIs, AI LLMs, and MCP integrations.
Apply MITRE ATT&CK and MITRE D3FEND to develop and validate detection and incident response playbooks.
Integrate threat intelligence, security tools, ticketing, and collaboration systems to support investigation and response.
Work with SecOps, Engineering, and Product teams to deliver practical security capabilities for SME customers.
Qualifications
Strong understanding of security monitoring principles and SOC operations.
Proven experience in deploying and managing SIEM platforms (e.g., Splunk, Elastic Security, QRadar, Microsoft Sentinel).
Working knowledge of Kafka, ClickHouse, S3, and Apache Flink, with the ability to consume, query, and process security data.
Familiarity with log formats, collection methods such as Syslog and APIs, and data parsing techniques.
Experience with Python, SQL, and API integrations.
Understanding of automation workflows, including triggers, conditions, retries, error handling, and approval controls.
Familiarity with AI LLMs and MCP concepts for security automation.
Knowledge of MITRE ATT&CK, MITRE D3FEND, and threat intelligence.
Understanding of network protocols, Windows, Linux, and cloud environments such as AWS, Azure, or GCP.
Strong troubleshooting, documentation, and communication skills.
Experience Requirements:
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
Minimum of 3 years of experience in cybersecurity, with a focus on SOC operations, SIEM administration, endpoint security, security automation.
Proven experience in at least one major SIEM platform implementation and management.
Demonstrated experience building integrations or automation through code and APIs. Experience with tools such as n8n is transferable, but n8n is not part of our current stack or a requirement.
Experience integrating security tools and platforms using APIs.
Professional Certifications (Preferred):
CompTIA Security+, CySA+, CASP+
GIAC certifications (e.g., GCIH, GCIA, GSEC)
Certified Information Systems Security Professional (CISSP)
