MTS-2 Security Operations Engineer

At eBay, we're more than a global ecommerce leader — we’re changing the way the world shops and sells. Our platform empowers millions of buyers and sellers in more than 190 markets around the world. We’re committed to pushing boundaries and leaving our mark as we reinvent the future of ecommerce for enthusiasts. Our customers are our compass, authenticity thrives, bold ideas are welcome, and everyone can bring their unique selves to work — every day. We're in this together, sustaining the future of our customers, our company, and our planet. Join a team of passionate thinkers, innovators, and dreamers — and help us connect people and build communities to create economic opportunity for all. Working within eBay's Computer Security Incident Response Team (CSIRT) Operations team, you will play a critical role in protecting eBay's information assets by monitoring, investigating, and responding to cybersecurity events. As a member of the CSIRT Ops team, you will help identify potential threats, perform alert  triage, phishing triage, respond to enquiries to CSIRT, escalate potential incidents to the Incident Response team.  You'll work in a fast-paced, highly collaborative environment where you'll contribute to the continuous monitoring, triage of the threats and malicious actions and help defend one of the world's largest e-commerce platforms. Core job functions include: Security Monitoring – Monitor global security events and alerts across enterprise security platforms in a 24x7 operational environment. Identify, classify, and prioritize security events for investigation. Incident Response – Perform initial investigation, triage, and analysis of security events. Support incident response activities by documenting findings, participating in investigation calls, and escalating incidents that require additional expertise in accordance with established procedures. Containment & Investigation – Execute approved containment actions to limit the impact of security incidents and assist with forensic preservation and investigation activities while maintaining appropriate chain of custody. Threat Detection – Analyze security alerts, identify indicators of compromise (IOCs), and recommend improvements to detection content and alert tuning to improve monitoring effectiveness and reduce false positives. Threat Intelligence – Collect, analyze, and disseminate relevant open-source intelligence (OSINT) to support investigations and improve situational awareness. Technology Improvement – Participate in the testing, evaluation, implementation, and continuous improvement of security technologies, detection capabilities, and operational processes. Escalations – Perform timely verbal and documented escalations to Detection & Response Engineers and on-call personnel when incidents require advanced investigation or exceed established response thresholds. Coverage – Participate in a rotating 24x7 shift schedule, including weekends and holidays, as required to support continuous global security operations. To be successful in this position, you should be familiar with: Security Operations – Security event monitoring, alert triage, incident classification, and response workflows within a Security Operations Center (SOC) or CSIRT environment. Incident Response – Security investigation methodologies, containment techniques, evidence preservation, and incident documentation. Threat Detection – Experience working with Security Information and Event Management (SIEM) platforms to investigate alerts, analyze logs, and identify malicious activity. Endpoint & System Security – Understanding of Windows, Linux, and endpoint security concepts, including basic forensic acquisition and investigation techniques. Networking Fundamentals – Knowledge of TCP/IP networking protocols including HTTP, DNS, FTP, DHCP, ARP, and experience using network analysis tools such as Wireshark or tcpdump. Threat Intelligence – Familiarity with