Senior Security Engineer, Detection & Response – SOC

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of monitoring and triaging events and alerts ingested by SIEM.

• Fine-tune detection content, minimize false positives, and address coverage gaps.

• Spearhead the design and ongoing enhancement of incident response playbooks.

• Conduct proactive threat hunting to identify malicious or anomalous activities.

• Enhance digital forensics processes, tools, investigations, and evidence management.

• Promote automation for alerting, enrichment, and triage workflows.

• Manage incident response efforts while coordinating with business partners.

• Document incidents, identify root causes, and implement remediation strategies.

• Facilitate structured, blameless post-incident reviews that include root-cause analysis and tracked action items.

• Develop and refine incident response metrics, escalation procedures, and program priorities.

⛳️ Requirements

• Proven experience in building or significantly enhancing a SOC/IR function, progressing a program from early-stage to production-ready.

• Over 5 years of experience in a SOC, incident response, or detection engineering role, with a demonstrated track record of overseeing an IR or monitoring program beyond basic queue work.

• Comprehensive understanding of the entire incident response lifecycle: preparation, detection, containment, eradication, recovery, and lessons learned.

• Practical experience with SIEM, including log ingestion, correlation rules, and detection fine-tuning.

• Background in forensic analysis and evidence management across host and cloud environments.

• Capability to create automation/scripting for triage and response using Python or similar languages.

• Familiarity with AWS, GCP, or Azure and knowledge of common attacker TTPs using MITRE ATT&CK framework.

• Ability to articulate risk in both technical and business-oriented terms.

• Strong written communication skills for creating playbooks and documenting incidents.

• Experience with SIEM tools in log correlation, alert tuning, and content development.

• Fundamental knowledge of digital forensics covering evidence collection and analysis across host, network, and/or cloud.

• Understanding of MITRE ATT&CK and common tactics, techniques, and procedures (TTPs) employed by threat actors.

• Possession of relevant certifications such as GCIH, GCFA, GCIA, OSCP, or equivalent.

• Experience with SOAR platforms and prior work in fintech, gaming, or industries with high fraud risk are considered advantageous.

• Must be authorized to work for any employer in the U.S.; employment visa sponsorship is not available.

🏝️ Benefits

• Company-sponsored medical, dental, and vision insurance plans.

• 401(k) plan with company matching contributions.

• Annual performance-based bonus.

• Flexible paid time off (PTO) to support a healthy work/life balance (2 weeks STRONGLY encouraged!).

• Generous paid leave policies, including 16-week paid parental leave and disability benefits.

• Flexible workplace arrangements and modern work schedules focused on achieving results rather than merely counting hours.

• Company-wide in-person events and team-building activities.

• Lifestyle enhancement programs.

• Provision of company equipment (available in Windows & Mac options).

• Annual performance reviews with opportunities for personal growth and career advancement.