A **Protiviti** is a business consulting firm that combines extensive experience and specialized services in risk management, compliance, ESG, cybersecurity, privacy, internal audit, and corporate investigation. The routine at Protiviti is summarized by continuous learning, inspiring changes, and the opportunity to give ***your best*** in an environment of knowledge sharing and diversity. Here, you will have the opportunity to impact our clients, our company, and our community, spreading a culture of ethics and compliance wherever you are. We are looking for a person to work in a hybrid model **in São Paulo.** **Responsibilities and attributes** * Monitor and triage alerts generated by SIEM, EDR/XDR, Cloud Security, and Identity Security, applying the playbooks and severity matrix defined by the client * Analyze logs and events from sources connected to the SOC — firewalls, endpoints, Microsoft 365, Entra ID, AWS, Azure, and other SaaS — to validate or discard compromise hypotheses * Investigate incidents by reconstructing the chain of events: origin, execution, movement, and impact * Register, classify, and manage incidents in the ticket management system, maintaining evidence quality and respecting contracted SLAs * Activate and communicate with clients according to the pre\-defined escalation flow, with technical clarity and a tone appropriate to the criticality * Execute containment and response actions within the scope authorized by the client (endpoint isolation, quarantine, account blocking, session revocation) * Manage the cycle of identified vulnerabilities: risk prioritization, remediation recommendation, and follow-up with the client * Document each service in a way that allows another analyst to resume the investigation without verbal context * ### **Detection Evolution** + Identify and report recurring false positives, proposing rule adjustments, exclusions, or qualified suppressions + Contribute to the construction and refinement of custom use cases per client, bringing the context observed in daily operations + Write, test, and document custom detection rules, mapped to MITRE ATT\&CK + Evaluate detection coverage gaps per client and propose new log sources or new use cases + Keep runbooks, playbooks, and the operation's knowledge base up to date### **Threat Hunting** + Perform structured analyses based on hypotheses derived from threat intelligence, previous incidents, emerging TTPs, or observed anomalies + Build exploratory queries on SOC data for frequency analysis, outliers, and deviation from normal environment behavior + Convert relevant findings into products: new detection rules, baseline adjustments, or hardening recommendations to the client### **Data Quality and Integrations** + Monitor ingestion health: silent sources, collection gaps, anomalous volume, missing or poorly normalized fields + Support onboarding of new clients and validation of new data sources + Automate repetitive triage and enrichment tasks through scripts and API integrations **Requirements and qualifications** **Technical** * Networking fundamentals: OSI model, TCP/IP, routing, topologies, DNS, HTTP/HTTPS, and the ability to interpret traffic from logs * Understanding of the operation and reading of firewall, IPS/IDS, proxy/content filter, and antivirus/EDR logs * Operational knowledge of Windows and Linux: processes, authentication, services, permissions, native logs, and execution artifacts * Notions of vulnerabilities and basic offensive security: how an attack manifests, what exploitation, privilege escalation, and persistence are * Familiarity with the incident management cycle: registration, classification, escalation, treatment, and closure * Notions of MITRE ATT\&CK as a common language for describing attacks * Ongoing or completed degree in IT, Information Security, or a related field — **or** a demonstrable self-taught trajectory (laboratories, training platforms, personal projects, CTFs) * Previous experience is not disqualifying: we accept first experience in security for those coming from support, infrastructure, networks, or service desk with a solid foundation * Ability to follow playbooks with rigor and to recognize when the situation goes beyond the playbook * Willingness to learn log querying and analysis at scale **Behavioral** * Investigative reasoning: ability to sustain or refute a hypothesis with evidence * Clear writing in Portuguese — ticket, report, and client communication have deliverable value * Process discipline and attention to detail (SOC is routine before it is adrenaline) * English for technical reading (documentation, advisories, threat intel reports) * Ethical posture and responsibility with client data; notions of confidentiality and LGPD **Additional information** Enjoy our benefits! Health and Well\-Being: * Amil Health and Dental Plan; * TotalPass with access to physical activities and leisure; * Physical and mental health programs (Eleva). Flexible Benefit: * Ifood Benefits Card: Flexible modality to manage your balance according to your preferences. Categories include: meal, food, home office, among others. Mobility: * Transportation Voucher; * Or reimbursement for app rides, shuttle, or parking, facilitating your commute (if you do not opt for VT) Recognition and Valuation: * PLR linked to goal achievement, bonuses for tenure, marriage or birth, and Day Off in your birth month. Development and Growth: * Annual assistance for books, courses, or events, and support for post\-graduation, graduation, and languages. Security: * Life Insurance for you and your beneficiaries. Here, you grow, develop, and are recognized. Come with us! Protiviti Brasil is an independent member firm of Protiviti Inc, which combines ethics, innovation, and purpose in its deliveries. With expertise in **risk management, compliance, ESG, cybersecurity, privacy, internal audit, and corporate investigation**, we offer specialized consulting for companies seeking to adapt and prosper in a constantly changing business environment. Our purpose goes further: to transform challenges into solutions that generate positive impact, connecting people and companies to a sustainable future. We live, daily, the values of **commitment, renewal, inclusion, collaboration, and integrity**. We act with the mission of creating a world where trust and sustainability are the basis of relationships, connecting companies to transformative solutions. In Brazil, we have offices in São Paulo, Barueri, Rio de Janeiro, and Belo Horizonte, delivering solutions that make a difference in Brazil and in projects
João Silva
Indeed · HR
João Silva
Indeed · HR
