Security Op Engineer

Robert Half Hong Kong Limited; Hong Kong; On-site; HKD 420,000 - 700,000; Full time

Job summary

Robert Half Hong Kong Limited is seeking a Security Operations Engineer to support the SOC for a mega-size critical project, focusing on threat detection, incident response, and real-time triage across enterprise SIEM platforms.

You will monitor alerts, investigate potential breaches, and develop playbooks and SOAR workflows while collaborating with infrastructure teams to tune SIEMs and reduce false positives.

Qualifications

• 2–4+ years in SOC operations or security engineering.
• Experience configuring or querying enterprise SIEM tools across multiple platforms.
• Fundamental knowledge of networks, OS security, and common attack vectors.

Responsibilities

• Monitor security alerts and perform real-time triage for a mega-size project.
• Investigate potential breaches and execute containment procedures.
• Ingest log sources, build detection rules, and maintain dashboards across SIEMs.
• Develop and refine SOC playbooks and SOAR workflows.
• Conduct root-cause analysis after incidents and tune alerting to reduce false positives.

Skills

SOC operations

Threat monitoring

Incident response

SIEM experience

Analytical troubleshooting

Change management

Tools

Splunk

Microsoft Sentinel

Elastic

QRadar

Job description

We are seeking a Security Operations Engineer to support the Security Operations Center (SOC) for a mega-size critical project. In this role, you will be on the front lines of threat detection, event triage, and incident response. You will gain hands‑on exposure to a diverse array of enterprise SIEM platforms, maintaining security telemetry and hardening defense capabilities across complex, high‑availability environments.

The Role

• SOC Incident Response: Monitor security alerts, perform real-time threat triage, investigate potential security breaches, and execute containment procedures for a mega-size critical project.
• Multi-SIEM Operations: Ingest log sources, manage data pipelines, build custom detection rules, and maintain dashboards across various enterprise SIEM platforms (e.g., Splunk, Microsoft Sentinel, Elastic, QRadar).
• Threat Detection & Analysis: Analyze security logs (firewalls, endpoints, identity, cloud) to identify suspicious behavior, indicators of compromise (IOCs), and emerging attack patterns.
• Process Automation: Develop and refine SOC playbooks and SOAR workflows to streamline incident response and improve response times.
• Continuous Improvement: Perform root‑cause analysis after incidents and collaborate with infrastructure teams to tune SIEM alerting and reduce false positives.

Your Profile

• Experience: 2-4+ years in SOC operations, threat monitoring, or security engineering environments supporting critical infrastructure.
• SIEM Exposure: Direct experience operating, configuring, or querying enterprise SIEM tools, with readiness to work across multiple platforms.
• Core Security Knowledge: Solid understanding of network protocols, OS security (Windows/Linux), MITRE ATT&CK framework, and common attack vectors.
• Certifications: CompTIA Security+, CySA+, GIAC (GCIH/GCIA), or vendor‑specific SIEM certifications are preferred.
• Operational Mindset: Strong analytical troubleshooting skills with a disciplined approach to high‑stakes incident handling platforms.
• Operational Skills: Strong problem‑solving abilities, disciplined change‑management habits, and clear communication skills.

Reference Number: 67010-0013495255