SOC Detection Engineer – Senior
Core
Build and develop detection engineering function to identify, investigate, and respond to security threats across Windows, Linux, and Kubernetes environments.
Role type
Senior SOC Detection Engineer
Builds
Detection content, SIEM rules, dashboards, and automated testing frameworks for security teams
Domain
Cybersecurity, SIEM, Threat Detection
Required skills
Splunk SPL, MITRE ATT&CK, Python, PowerShell, Bash, Git, CI/CD, Windows/Linux security monitoring, incident investigation, threat hunting
Preferred skills
Splunk Enterprise Security, Sysmon, osquery, Tetragon, Docker, Kubernetes, YARA, Terraform, Ansible
Technologies
Splunk, MITRE ATT&CK, Python, PowerShell, Bash, Git, CI/CD, Sysmon, osquery, Tetragon, Docker, Kubernetes, YARA, Terraform, Ansible
Responsibilities
Develop, test, deploy, and maintain detection and correlation rules in Splunk; Translate incident investigations and attack research into effective detections; Analyze false positives, false negatives, and detection gaps; Improve detection coverage and map detections to MITRE ATT&CK techniques; Develop and optimize SPL queries, dashboards, and risk-based detections; Define requirements for logging, parsing, normalization, and data quality; Develop monitoring and health checks for detection rules; Contribute to automated detection testing and CI/CD workflows; Participate in incident investigations, threat hunting, and purple team exercises; Collaborate with SOC, Incident Response, and Engineering teams; Document detection logic and dependencies.
Seniority
Senior, hands-on IC
