Security Engineer (IC)

The Security Engineer (IC) will handle practical security operations across the RAKSUL Group. The immediate focus is establishing and embedding detection and response capabilities. The role covers SOC launch and internalization, support for selecting external vendors, definition of monitoring scope and escalation flows, vendor control, SLA management, assessment of reporting quality, and requests for operational improvement.

Responsibilities include reviewing and tuning EDR and SIEM detection rules, reducing false positives, expanding detection coverage, and managing incidents from initial response through investigation, recovery, and reporting. The role also coordinates with business continuity planning and plans cyber exercises. For the financial business, responsibilities include an early-notification structure for authorities. Work with group subsidiaries includes security assessments, support for remediating identified issues, and activities related to post-M&A PMI. Financial-business work also includes designing monitoring and response based on financial-sector security requirements and participating in risk assessments. Playbooks and procedures must be documented, and automation should be used to reduce operational workload and create a less person-dependent operating model.

Required experience includes practical work in a SOC or CSIRT, covering alert triage, analysis, escalation, and closure; operating security products such as EDR and SIEM, including direct involvement in creating or tuning detection rules; and practical incident response coordinated with relevant departments from initial action through reporting. Candidates must understand logs and security settings in public-cloud environments such as AWS or GCP, have documented procedures or playbooks, and have experience coordinating across departments. Experience planning and executing the introduction of external vendors or the launch of an operating structure, including project management, and experience conducting security audits or interviews are also required.

Preferred experience includes leading MSSP selection or launch, working with vendors or MSSPs, moving to an internally operated SOC, improving operations through automation or scripting, performing security assessments and PMI for group companies or M&A targets, understanding financial-sector security requirements, leading vulnerability assessments, conducting forensic work or penetration tests, practicing security by design, and understanding or operating ISO 27000-series and JIS Q 15001 requirements.

The position belongs to the Technology Division, Corporate Technology Department, Information Security Strategy Office. The group operates printing and customer-acquisition, marketing, IT-device and SaaS-management, and financial businesses, with subsidiaries increasing through ongoing M&A. The role is based at the Azabudai office or an approved home or equivalent remote-work location, using a hybrid arrangement with remote work and several office days each week.