Security Operations Engineer

We are looking for a Security Operations Engineer to monitor, detect, and respond to threats across our infrastructure and services. You will own security monitoring and incident response, including SIEM operations, alert triage, and threat investigation. You will work closely with DevOps and engineering teams to improve detection capabilities and strengthen system security.ResponsibilitiesMonitor and triage security alerts from SIEM, EDR, and cloud security toolsInvestigate security incidents, contain threats, and contribute to post-incident reviewsMaintain and tune detection rules to improve signal quality and reduce false positivesTrack and coordinate vulnerability remediation across infrastructure and servicesPerform access control reviews, privileged account audits, and maintain IAM hygieneMaintain security runbooks, playbooks, and incident response documentationSupport SOC 2 and ISO 27001 audits, including evidence collection, control validation, and gap remediationConduct scheduled internal security assessments and assist with penetration test scopingCollaborate with DevOps on system and cloud configuration hardeningRequired Skills & ExperienceSecurity Operations2+ years in a security operations, SOC, or similar roleExperience with at least one SIEM platform (e.g., Elastic SIEM, Splunk, Datadog Security, Microsoft Sentinel)Experience with alert triage, log analysis, and basic threat huntingFamiliarity with the MITRE ATT&CK framework for incident classificationExperience with at least one EDR platform (e.g., CrowdStrike Falcon, SentinelOne, Wazuh)Experience with vulnerability scanning tools (e.g., Nessus, OpenVAS, Qualys)Cloud & Infrastructure BasicsWorking knowledge of AWS or GCP security controls (e.g., Security Groups, IAM, CloudTrail, GuardDuty)Operational-level Windows & Linux administration (e.g., log analysis, process inspection, basic system hardening)Familiarity with containerized environments (Docker, Kubernetes) from a security perspectiveCompliance & DocumentationExperience supporting SOC 2 or ISO 27001 auditsAbility to write clear incident reports, runbooks, and policy documentationExperience with access review processes and IAM audits Scripting & AutomationScripting proficiency in Bash or Python for operational automation (e.g., log parsing, report generation)No advanced software development experience requiredNice to haveExperience with SOAR platforms (e.g., Tines, Shuffle, Splunk SOAR)Experience with network traffic analysis tools (e.g., Zeek, Suricata, Wireshark)Familiarity with threat intelligence feeds and IOC managementExperience with zero-trust tools (e.g., Cloudflare Access, Tailscale, NetBird)Relevant certifications (e.g., CompTIA Security+, CEH, GCIH)What we offerCompetitive salaryRemote-first, async-friendly teamDedicated budget for security tooling and trainingClear growth path toward Senior SecOps or DevSecOps Engineer, with increasing ownership of detection engineering, automation, and security architecture