IT Security Engineer

Overview

The SOC Engineer serves as the technical lead for the organization’s SIEM platform and acts as the SOC’s Tier 3 escalation resource. This position is responsible for designing, tuning, and continuously improving detection content, creating and maintaining SOAR playbooks and ensuring adherence, and providing deep investigative expertise for the most complex security incidents. The ideal candidate brings hands-on SIEM engineering and query-language skills along with the judgment and leadership needed to mentor Tier 1 and Tier 2 analysts and help shape the SOC’s detection strategy.

Key Responsibilities

• Own and continuously improve the SIEM platform, including analytics and correlation rules, dashboards, data connectors, ingestion and cost management, and the overall detection roadmap.
• Lead detection engineering by designing, building, tuning, and validating analytics rules across identity, endpoint, cloud, and network telemetry.
• Serve as the SOC’s Tier 3 escalation point, conducting deep technical investigations, root-cause analysis, and forensic collection for the most complex or high-severity incidents.
• Design, build, and maintain SOAR playbooks and drive consistent analyst adherence to documented playbook procedures.
• Build automation and enrichment pipelines, including AI-assisted triage where applicable, to reduce manual effort and improve mean time to detect and mean time to respond.
• Mentor Tier 1 and Tier 2 SOC analysts by reviewing investigations and coaching on playbook execution.
• Evaluate, onboard, and tune new log sources, data connectors, and threat intelligence feeds to expand detection coverage.
• Partner with IAM, endpoint, and network security teams to ensure detection coverage keeps pace with control and infrastructure changes.
• Track and report detection engineering and SOC performance metrics such as MTTD, MTTR, playbook adherence, and false-positive rates.
• Maintain thorough documentation for detection logic, playbooks, and incident response procedures.
• Participate in an on-call rotation and respond to security incidents after hours when necessary.

Minimum Requirements

• 4+ years of experience in cybersecurity, including at least 2 years of hands-on experience with an enterprise SIEM platform and its query language(s).
• Proven experience leading or serving as a senior or Tier 3 resource within a SOC or incident response function.
• Strong hands-on experience building and tuning SIEM analytics rules and detection content.
• Experience designing and maintaining SOAR playbooks or equivalent security orchestration or automation tooling.
• Solid incident response and forensics experience, including investigation, evidence handling, and documentation.
• Proficiency with scripting and automation (PowerShell, Python, or similar).
• Experience integrating security tooling (EDR, email security, identity, network) into a SIEM for detection and correlation.
• At least one relevant security certification, for example GCIA, GCIH, CySA+, Security+, or vendor-specific SIEM certifications.
• Strong understanding of the MITRE ATT&CK framework and common adversary tactics, techniques, and procedures.
• Ability to respond to security incidents after hours when necessary.

Preferred Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent experience).
• Experience developing SIEM dashboards and reporting, including executive or board-level reporting on security metrics.
• Experience with AI or LLM-assisted alert enrichment or triage pipelines.
• Familiarity with common enterprise security stack components such as EDR, secure web gateway or CASB, identity providers, and email security, and how they integrate into detection workflows.
• Familiarity with SOC 2, risk assessments, and other GRC functions.
• Advanced certifications (for example GCFA, GCTI, OSCP, CISSP) are a plus.
• Excellent problem-solving skills and the ability to lead through ambiguity under pressure.
• Strong communication skills, including the ability to convey technical findings to both technical and non-technical stakeholders.

Physical Demands

The physical demands described are representative of those that must be met by an employee to successfully perform the essential functions of this job. While performing the duties of this job, the employee is regularly required