Manager

Job Overview: We are seeking an experiencedSenior Security Operations Engineerto strengthen and scale our Security Operations Center (SOC) capabilities, threat detection frameworks, and incident response operations. In this role, you will be responsible for monitoring complex cloud and on-premises environments, engineering high-fidelity detection rules, and automating response playbooks to defend against sophisticated cyber threats. You will collaborate closely with Infrastructure, DevOps, and Software Engineering teams to ensure comprehensive security visibility, proactive threat hunting, and rapid containment of security incidents. Key ResponsibilitiesThreat Detection & Security Automation Design, build, and optimize detection engineering pipelines using SIEM, EDR, and log management platforms (e.g., Splunk, Datadog, CrowdStrike). Develop and maintain automated incident response playbooks and orchestration workflows (SOAR) to reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Perform proactive threat hunting using threat intelligence feeds, MITRE ATT&CK frameworks, and behavioral analysis to identify undetected malicious activity. Incident Response & Digital Forensics Serve as an escalation point for high-priority security alerts, leading end-to-end incident response, containment, and forensic investigations. Conduct root-cause analysis following security events, author detailed post-mortem reports, and track long-term remediation action items. Participate in on-call rotations for critical security incidents and lead tabletop exercises to test organizational readiness. Security Monitoring & Infrastructure Onboard new log sources, data feeds, and cloud services into central monitoring infrastructure, ensuring data integrity and retention compliance. Audit and harden infrastructure, network perimeters, and multi-cloud environments (AWS, GCP, or Azure) against emerging vulnerabilities. Define SOC operational metrics, key risk indicators (KRIs), and executive dashboards to measure security posture and operational efficiency. Required Skills & QualificationsTechnical Skills & Expertise Security Operations & Detection: Advanced expertise with SIEM solutions (Splunk, Elastic, Datadog), EDR/XDR platforms, and network detection systems. Scripting & Automation: Strong proficiency in Python, Bash, or PowerShell for automating security workflows, log parsing, and API integrations. Cloud & Network Security: Deep understanding of cloud architecture security (AWS/GCP/Azure), container security (Docker, Kubernetes), and network protocols (TCP/IP, DNS, TLS). Frameworks & Methodologies: Applied knowledge of the MITRE ATT&CK framework, Cyber Kill Chain, OWASP Top 10, and NIST Incident Handling guidelines. Forensics & Analysis: Hands‑on experience with memory forensics, log analysis, packet capture analysis (Wireshark), and malware triage. Soft Skills & Leadership Strong analytical problem‑solving skills with the ability to maintain composure during critical security incidents. Clear communication skills to translate complex security findings into clear actionable advice for technical and non-technical stakeholders. Preferred QualificationsEducation: Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or equivalent practical experience.