SOC Detection Engineer (US Remote)

• Design, implement, and maintain SOC Tooling: Deploy, configure, and optimize SIEM, EDR, and SOAR platforms to support robust security operations, threat detection, and incident response.
• Automation and Orchestration: Architect and develop automation workflows using SOAR platforms, leveraging scripting, APIs, and integration with other security tools to enhance operational efficiency.
• AI and Advanced Analytics: Evaluate, implement, and maintain AI-powered security solutions for threat detection, anomaly detection, and automated response, collaborating with data scientists and security analysts.
• Use of Query and Programming Languages: Develop and optimize complex detection rules, searches, and reports using query languages as well as scripting and programming languages (such as Python, PowerShell, or JavaScript).
• Threat Detection and Incident Response Support: Collaborate with SOC analysts to tune detection logic, automate repetitive tasks, and ensure rapid, precise response to security incidents.
• Incident Response: Provide hands-on support during security incidents, including investigation, containment, eradication, and recovery activities. Work with SOC analysts and other stakeholders to analyze incidents, develop response strategies, and implement corrective actions.
• Security Monitoring: Continuously monitor enterprise systems, networks, and endpoints for suspicious activity, indicators of compromise, and vulnerabilities. Ensure security alerts are effectively triaged, investigated, and escalated as needed.
• Integration and Engineering: Design and implement integrations between SIEM, EDR, SOAR, and other security or IT systems, ensuring seamless data flow and coordinated defense mechanisms.
• Enterprise System Integration: Build and maintain connections between SOC tools and enterprise systems (such as ERP, HRIS, CRM, and other business applications) to enable comprehensive security monitoring and ensure visibility across the organization.
• Continuous Improvement: Proactively monitor tool performance, analyze metrics, and drive improvements in detection, automation, and response capabilities.
• Documentation and Knowledge Sharing: Create and maintain clear documentation for detection rules, automation workflows, and SOC tooling architecture. Share best practices with peers and mentor junior team members.
• Collaboration: Work closely with IT, engineering, and application teams to ensure that security controls are integrated into business processes and technical solutions.
• Compliance and Regulatory Support: Assist in ensuring SOC tooling and processes meet compliance requirements, such as PCI-DSS, HIPAA, GDPR, or industry best practices.
• Participate in an on-call rotation as needed, typically once a month, to provide timely support for critical incidents and maintain the security posture of the organization.

• Bachelor’s degree in Computer Science, Information Security, or a related technical discipline, or equivalent work experience.
• Minimum of 5 years’ experience in cybersecurity engineering, SOC operations, or similar roles.
• Hands-on experience with SIEM platforms, EDR tools, and SOAR solutions.
• Proficiency building and maintaining automation and orchestration workflows using scripting languages (Python, PowerShell, Bash, etc.).
• Strong skills in query languages for threat hunting and detection rule creation.
• Experience integrating and supporting AI/ML security tools and applying analytics for threat detection.
• Solid understanding of security operations, threat landscapes, and incident response methodologies.
• Experience integrating security tools with APIs and developing custom connectors or enrichment scripts.
• Experience integrating SOC tooling with enterprise systems for security monitoring and data correlation.
• Excellent analytical, problem-solving, and troubleshooting abilities.
• Strong verbal and written communication skills, with the ability to explain technical concepts to both technical and non-technical audiences.
• Willingness to participate in an on-call rotation, typically once a month.

• Innovative Mindset: Enthusiasm for exploring and integrating new technologies to advance SOC capabilities.
• Team Player: Collaborative spirit with a willingness to mentor, share knowledge, and support fellow engineers and analysts.
• Adaptability: Comfort in a fast-paced, evolving environment with shifting priorities and new challenges.
• Attention to Detail: Diligence in designing precise detection logic, automations, and documentation to ensure accuracy and reliability.
• Ethical Approach: Unwavering commitment to upholding security, privacy, and compliance standards.

• Relevant cybersecurity certifications.
• Experience working with cloud security tools and environments and their native security features.
• Knowledge of threat intelligence platforms, vulnerability management systems, and network security solutions.
• Background in DevSecOps, CI/CD pipeline security, or security testing automation.
• Familiarity with compliance frameworks and regulatory requirements.
• Experience collaborating with cross-functional teams in large or complex enterprise environments.

United States Equal Opportunity Employment:

First Advantage is proud to be a global leader in removing barriers and supporting our community members to ensure the changing demographics of the workforce are reflected in our hiring and employment practices. We value all of our candidates, employees, and clients, and place great emphasis on hiring and supporting qualified individuals in each role. We are an equal opportunity employer. We do not discriminate on the basis of race, color, ethnicity, ancestry, religion, sex, national origin, sexual orientation, age, citizenship status, marital status, disability, gender identity, gender expression, veteran status, genetic information, or any other area protected by applicable law.