Senior Security Operations Engineer

Bachelor’s Degree in Computer Science, Cybersecurity, Information Systems, or related discipline, or equivalent experience.

Minimum of 5 years of experience in cybersecurity, with at least 3 years focused on security operations, incident response, or a SOC environment.

Hands-on depth with SIEM platforms — Splunk (SPL), Microsoft Sentinel (KQL), or equivalent — including building and tuning complex correlation rules, not just running queries.

Practical experience with EDR platforms (SentinelOne strongly preferred) and a solid understanding of endpoint telemetry, memory processes, and detection tuning across Windows, macOS, and Linux.

Proficiency in Python for scripting detection logic, automation workflows, and investigation tooling. PowerShell and Bash proficiency a plus.

Working knowledge of SOAR platforms (Splunk SOAR/Phantom, Cortex XSOAR, or similar) and demonstrated ability to build — not just execute — automated playbooks.

Solid grounding in AWS security services (GuardDuty, Security Hub, CloudTrail, IAM) and experience conducting investigations in cloud-native environments.

Deep familiarity with MITRE ATT&CK as a practical framework for threat hunting, detection coverage mapping, and adversary emulation — not just as a reference.

Experience performing digital forensics, including evidence collection, memory analysis, log correlation, and articulating findings in written and verbal post-incident reviews.

Relevant certifications valued: CISSP, GCIH, GCFA, GREM, OSCP, or cloud security credentials (AWS Security Specialty). Preferred but not required.

Creative problem solver who questions inherited processes and redesigns them for scale. You see alert fatigue as an engineering problem, not an analyst problem.

Proven ability to operate with urgency and clarity under pressure, lead cross-functional response without direct authority, and keep stakeholders informed without overwhelming them.

Familiarity with AI coding assistants (Claude Code, GitHub Copilot, or equivalent) as active workflow tools — directing them for complex tasks like automation scripting, detection drafting, and technical documentation, with the judgment to know when to trust the output and when to rewrite it.

Working familiarity with the OWASP LLM Top 10 and MITRE ATLAS framework as practical tools for threat modeling LLM-backed systems and identifying detection coverage gaps. Curiosity about agentic SOC automation valued over deep prior expertise.

Strong written and verbal communicator who translates complex threat scenarios into language that resonates with engineers, executives, and board members alike. You elevate the team around you through coaching and knowledge sharing.