Lead L2/L3 SOC Engineer: Build SIEM & Incident Response

Solidgate; Spanien; Vor Ort; EUR 65.000 - 98.000; Vollzeit

Benefits dieser Stelle

30+ days off

Unlimited sick leave

Free meals

Health coverage

Apple gear

Courses & conferences

Zusammenfassung

Solidgate is seeking a hands-on SOC/Detection professional to own and evolve the security operations for a fintech payments platform. You will design SIEM detection, map rules to MITRE ATT&CK, and lead incident response in a regulated environment with real cardholder data.

You will onboard AWS, JumpCloud, Google Workspace, CDE, and SWIFT logs, run threat hunts, and build runbooks, balancing automation with rigorous post‑mortems. A senior, proactive mindset is essential.

Qualifikationen

• 3+ years in SOC/Detection & Response with hands-on investigation.
• Experience building or operating a SIEM and tuning rules.
• Detection engineering with MITRE ATT&CK mapping; proficient in KQL, SPL.
• Experience investigating cloud logs: AWS CloudTrail, GuardDuty, Google Workspace.
• Scripting/automation (Python or similar) for telemetry processing.

Aufgaben

• Build and operationalize the SIEM from PoC to production with UEBA.
• Design and tune detection rules mapped to MITRE ATT&CK.
• Triage L2/L3 alerts; reduce false positives; set escalation paths.
• Lead incident response, containment, eradication, and lessons learned.
• Onboard log sources across AWS, JumpCloud, Google Workspace, CDE, SWIFT.
• Run threat hunts based on attack hypotheses for a payment platform.
• Create runbooks and automate actions via SOAR or scripting.
• Define SOC metrics and monthly management reporting.

Kenntnisse

SOC / Detection & Response

Hands-on investigation

MITRE ATT&CK mapping

KQL / SPL

Python scripting

Cloud logs (AWS/Google Workspace)

Threat hunting

SOAR / detection as code

UEBA

Tools

SIEM

SOAR

CI pipelines

Jobbeschreibung

Solidgate is seeking a hands-on SOC/Detection professional to own and evolve the security operations for a fintech payments platform. You will design SIEM detection, map rules to MITRE ATT&CK, and lead incident response in a regulated environment with real cardholder data.

You will onboard AWS, JumpCloud, Google Workspace, CDE, and SWIFT logs, run threat hunts, and build runbooks, balancing automation with rigorous post‑mortems. A senior, proactive mindset is essential.