Senior SOC Detection Engineer (L2/L3): Build From Ground Up

Solidgate; København; Sur place; DKK 900 000 - 1 400 000; Plein temps

Avantages offerts par ce poste

30+ days off

Unlimited sick leave

Free office meals

Health coverage

Apple gear

Résumé du poste

Solidgate is expanding its security operations team to scale defenses for a high‑volume fintech payments platform. You will own detection engineering, SIEM/SOAR implementations, and incident response in a regulated environment, with hands‑on work across cloud logs, runbooks, and threat hunts.

You will shape detection coverage, escalate appropriately, and collaborate with a senior InfoSec team to continuously improve monitoring and response capabilities.

Qualifications

• 3+ years in SOC / Detection & Response with hands-on investigation experience.
• Practical experience building or operating a SIEM and tuning detection rules.
• Detection engineering with MITRE ATT&CK mapping; proficient in KQL, SPL, or equivalent.
• Experience investigating cloud log sources (AWS CloudTrail, GuardDuty, Google Workspace).
• Scripting and automation skills (Python or similar) for telemetry processing.

Responsabilités

• Build and operationalize the SIEM from PoC to production with case management and UEBA.
• Design, write, and tune detection rules mapped to MITRE ATT&CK.
• Triage and investigate L2/L3 alerts; reduce false positives and set escalation paths.
• Lead incident response and basic forensics; containment, eradication, lessons learned.
• Onboard log sources across AWS, Google Workspace, CDE, and SWIFT.
• Run threat hunts based on realistic attack hypotheses for a payment platform.

Connaissances

SOC / Detection

Investigation experience

MITRE ATT&CK

KQL / SPL

Cloud logs

Python scripting

Threat understanding

Outils

SIEM

SOAR

Description du poste

Solidgate is expanding its security operations team to scale defenses for a high‑volume fintech payments platform. You will own detection engineering, SIEM/SOAR implementations, and incident response in a regulated environment, with hands‑on work across cloud logs, runbooks, and threat hunts.

You will shape detection coverage, escalate appropriately, and collaborate with a senior InfoSec team to continuously improve monitoring and response capabilities.