Senior Security Engineer

About the role

Cision is looking for a Senior Security Engineer to monitor, investigate and respond to security activity across cloud, identity, endpoint and Linux-based environments. The role needs hands-on technical ability, strong scripting skills and practical experience with AWS, with GCP experience preferred. It is based remotely, with locations listed as Hungary and Sofia.

Key responsibilities

• Monitor and investigate security alerts across cloud, identity, endpoint and network environments.
• Review logs and activity from AWS, GCP, Active Directory, Linux, Windows and security tools.
• Support incident response by gathering evidence, validating suspicious activity and documenting findings.
• Write scripts to automate security tasks, log analysis, reporting or enrichment.
• Assist with security reviews of IAM, storage exposure, compute workloads and network configurations.
• Investigate authentication activity, user behaviour, privilege changes and potential account compromise.
• Work with internal teams to understand systems, identify risks and support remediation, compliance and audit.
• Be available for after-hours incident response when urgent events occur.

Required profile

• 3-5 years of experience in security operations, incident response, systems administration, cloud operations or a similar technical role.
• Hands-on experience using scripts to solve operational or security problems.
• Comfortable working in cloud and Linux command-line environments.
• Availability for after-hours incident response.

Required skills

• Cloud security concepts, services, logs and IAM.
• Scripting, preferably Python, Bash or PowerShell.
• SIEM platforms such as Splunk, Chronicle, Sentinel or similar.
• Linux and Windows command line, permissions, processes and logs.
• Active Directory basics (users, groups, authentication, privilege changes).
• Reading logs from cloud platforms, operating systems and security tools.
• Knowledge of phishing, credential compromise, privilege escalation, lateral movement and exposed services.

Preferred: GCP security (IAM, Cloud Logging, Compute Engine, Cloud Storage, VPCs, service accounts), Kubernetes or containers, security automation, and GitHub/GitLab. The interview includes a hands-on practical exercise via screen sharing.