Lead Detection & Response Platform Engineer
Core
Own and engineer the platform for triaging alerts and responding to security incidents, covering SIEM, XDR, SOAR, and case-management tools.
Role type
Senior IC security platform engineer (detection & response)
Builds
Automated triage and incident response workflows, playbooks, and integrations connecting identity, endpoint, cloud, email, and network telemetry.
Domain
Cybersecurity / Security Operations (SOC)
Required skills
Alert triage process design, SOAR playbook development, SIEM query languages (KQL/SPL), Python/PowerShell, REST APIs, Git version control, MITRE ATT&CK mapping, incident coordination, technical writing, mentoring
Preferred skills
Microsoft security stack (Sentinel, Defender, Logic Apps), Detection-as-code/CI/CD, Cloud security (Azure/AWS), LLM application in security workflows, SOC maturity models (NIST, SOC-CMM)
Technologies
SIEM, XDR, SOAR, Git, Python, PowerShell, KQL, SPL, Terraform, Bicep/ARM, Azure, AWS, Entra ID, Logic Apps
Responsibilities
Define alert classification, enrichment, prioritization, investigation, and escalation standards; Build automation pipelines and SOAR playbooks; Manage the detection stack configuration and integrations; Measure and optimize triage performance metrics; Coordinate cross-functional incident response; Mentor analysts and engineers in process design and automation.
Seniority
Senior, hands-on IC with mentorship responsibilities
