SOC Engineer / Detection Engineer

As a SOC Engineer / Detection Engineer, you will be responsible for detecting, investigating, and responding to security incidents across our environment, while continuously improving how we detect and handle threats. You will work hands-on with our SIEM and incident response processes, and act as a key point of contact between the SOC and other engineering/security teams.

Depending on your profile, some of your responsibilities can include:

  - Incident Response: Lead and support the end-to-end response to security incidents, from detection through containment, eradication, and recovery.

  - Security Investigation: Conduct in-depth investigations into suspicious activity and alerts, correlating data across logs, endpoints, network, and cloud sources to determine root cause and impact.

  - Post-Mortems & RCAs: Drive post-incident reviews and root cause analyses (RCAs), documenting timelines, findings, and actionable follow-ups.

  - SIEM Engineering: Implement, tune, and maintain SIEM use cases, detection rules, correlation logic, and alerting to reduce false positives and close detection gaps.

  - SIEM Support: Provide ongoing support for the SIEM platform, including onboarding new log sources, troubleshooting data ingestion, and maintaining dashboards/reports.

  - Cross-Team Collaboration: Partner with Engineering, IT, and other Security teams to remediate findings, validate fixes, and share threat context.

  - Process Improvement: Identify gaps in detection, response, and documentation, and drive improvements to playbooks, runbooks, and SOC workflows.

**Must have:**

  - Incident Response: Hands-on experience handling security incidents, including triage, containment, and coordination across teams.

  - Investigation Skills: Strong analytical ability to investigate alerts and logs (SIEM, EDR, network, cloud) and determine root cause.

  - SIEM Expertise: Practical experience implementing and tuning detection rules/use cases in a SIEM (e.g., Splunk, Sentinel, Elastic, QRadar).

  - RCA & Documentation: Proven ability to write clear post-mortems, RCAs, and incident reports for both technical and non-technical audiences.

  - Communication: Ability to work cross-functionally with engineering and other security teams, translating findings into clear remediation steps.

  - Process Mindset: Track record of identifying and driving improvements to detection and response processes.

  - Linux/Unix proficiency and comfort working across cloud (e.g., AWS) log sources.

**Nice to have:**

  - Experience with detection engineering frameworks (e.g., MITRE ATT&CK) to map and prioritize coverage.

  - Familiarity with scripting/automation (Python, etc.) for detection or response tasks.

  - Understanding of compliance frameworks (ISO 27001, NIST, SOC2) as they relate to incident response.

  - Relevant certifications (e.g., GCIH, GCFA, Security+, SC-200, or SIEM-specific certifications).