Responsibilities

• Design, develop, and maintain security automation and SOC tooling, including integrations with SIEM, EDR, cloud services, and internal security platforms
• Develop services, scripts, and pipelines to automate alert enrichment, correlation, response, and investigation workflows
   
• Build and maintain API-based integrations with security tools, AWS services, and internal systems
   
• Support and enhance SIEM platforms for ingestion, alerting, and investigation
   
• Participate in security detection engineering, including log parsing, data normalization, and detection logic implementation
   
• Assist in security incident response, including triage, investigation, containment, eradication, and post-incident analysis
   
• Take part in SOC on-call rotation / shift duty, responding to security alerts and incidents as required
•  
   
  Work closely with SOC analysts to translate operational needs into scalable engineering solutions, debug, troubleshoot, and optimize existing security automation, CI/CD pipelines, and platform components etc.

Requirements

• 4+ years in a SOC or security operations role with incident response focus.
• Proven experience with DLP design, deployment, and monitoring.
• Strong programming skills (macOS Swift, Unix socket programming, scripting).
• Hands-on threat hunting, forensic analysis, and APT detection experience.
• Familiarity with SIEM, EDR, and cloud security architectures.
• Knowledge of encryption, tokenization, and data classification methods.

Nice-to-have

• 4+ years in a SOC or security operations role with incident response focus.
• Proven experience with DLP design, deployment, and monitoring.
• Strong programming skills (macOS Swift, Unix socket programming, scripting).
• Hands-on threat hunting, forensic analysis, and APT detection experience.
• Familiarity with SIEM, EDR, and cloud security architectures.
• Knowledge of encryption, tokenization, and data classification methods.