Security Verification Engineer (Cyber Defense - Gov't Project)

Description Solafune Co., Ltd. is a startup aiming to build a "Planetary Intelligence OS." With satellite data analysis and AI analysis at its core, it is rapidly building a track record of transactions with government agencies in fields such as defense and security, infrastructure monitoring, and environmental monitoring. In a security system optimization project for government agencies, this position is responsible for testing and validating security products such as SIEM, threat intelligence, and IDS/IPS, as well as conducting technical information interviews and documentation with external experts and vendors. Designing and verifying log correlation rules is the technical core of this role, and you will also be involved in applying configuration settings to actual devices. Depending on your skill orientation, we welcome individuals who can excel in either a simulation-focused or external information integration-focused capacity. Main Job Responsibilities Configuration and validation of security products such as SIEM, threat intelligence platforms, and IDS/IPS Design and testing of correlation rules integrating two types of logs (network detection logs + threat intelligence feeds) Interviews regarding technical specifications and recommended parameters with external experts and vendor SEs, as well as systematic documentation Research and organization of existing similar cases and vendor-recommended values, supporting their reflection into design policies Recording validation results and creating reports (implementation records, validation result reports) Participation in configuration work on actual devices at designated facilities in Tokyo (1-2 times per month) Requirements Configuration and operation experience with SIEM: Any of Splunk / IBM QRadar / Microsoft Sentinel / LogRhythm Configuration and tuning experience with IDS/IPS: Any of Suricata / Snort or commercial products (Trend Micro, Cisco, etc.) Basic practical experience in threat intelligence: Understanding of IoC concepts and feed utilization Basic operation of Linux and Docker Document creation capability based on technical interviews Structured questioning ability: Capability to design questions that extract necessary technical information from external experts Tolerance for ambiguous situations: Ability to proceed with work even at stages where products to be used and implementation methods are not fully finalized Meticulous recording capability: Ability to document interview details and validation results in a form that can be referenced later Tools and Product Experience SIEM: Splunk Enterprise/Cloud or Microsoft Sentinel (Experience with either one is acceptable) Threat Intelligence: MISP or OpenCTI (Experience with either one is acceptable) IDS/IPS: Suricata or Trend Micro TippingPoint (Experience with either one is acceptable) Container: Docker / Docker Compose (Basic operation) Scripting: Python (REST API operation, log processing) Preferred Experiences Registered Information Security Specialist (RISS / 情報処理安全確保支援士) Splunk Core Certified Power User CompTIA CySA+ or GCIH We are looking for Those who can understand the characteristics of projects for government agencies and highly confidential projects, and approach their work with a strong sense of ethics and responsibility. Those who prioritize information security and compliance, and can thoroughly manage confidential information appropriately. Those who can adhere to internal and external rules and security policies, and carry out their duties carefully and honestly. Those who can flexibly accommodate regular business trips to designated facilities in Tokyo. Those who have no resistance to working in a secure environment isolated from networks and can focus on their work. Those who can collaborate smoothly with stakeholders and contribute to generating results as a team. Those who feel fulfillment in highly public missions and have an interest in social infrastructure and defense/security fields.