IT Security Engineer

About the role

The SOC Engineer is the technical lead for the organization's SIEM platform and serves as the SOC's Tier 3 escalation resource. This role owns the design, tuning, and continuous advancement of detection content, drives SOAR playbook creation and adherence, and provides deep investigative expertise for the most complex security incidents. The ideal candidate combines strong hands-on SIEM engineering and query-language skills with the judgment and leadership to mentor Tier 1/2 analysts and shape the SOC's detection strategy.

Responsibilities

• Own and advance the organization's SIEM platform, including analytics/correlation rules, dashboards, data connectors, ingestion/cost management, and the overall detection roadmap.
• Lead detection engineering efforts: design, build, tune, and validate analytics rules across identity, endpoint, cloud, and network telemetry.
• Serve as the SOC's Tier 3 escalation point, performing deep technical investigation, root-cause analysis, and forensic collection on the most complex or high-severity incidents.
• Design, build, and maintain SOAR playbooks and drive consistent analyst adherence to documented playbook procedures