SOC Detection Engineer: Incident Response & SIEM

Talkdesk; Porto; On-site; EUR 50,000 - 70,000; Full time

Job summary

Talkdesk is seeking a SOC Engineer / Detection Engineer to detect, investigate, and respond to security incidents across our environment. You will work hands-on with our SIEM, IR processes, and serve as a liaison between the SOC and other engineering/security teams.

Responsibilities include leading incident response, conducting in-depth investigations, driving RCAs, tuning SIEM use cases, and improving SOC playbooks and runbooks.

Qualifications

• Hands-on incident response across triage, containment, and coordination.
• Strong analytical skills to investigate alerts and logs from multiple sources.
• Experience implementing/tuning SIEM rules and use cases.
• Ability to document post-mortems and RCAs clearly for technical and non-technical audiences.
• Effective cross-team communication with engineering and security teams.
• Track record of improving detection and response processes.
• Linux/Unix proficiency; comfortable with AWS log sources.

Responsibilities

• Incident Response: Lead and support the end-to-end response to security incidents, from detection through containment, eradication, and recovery.
• Security Investigation: Conduct in-depth investigations into suspicious activity and alerts, correlating data across logs, endpoints, network, and cloud sources to determine root cause and impact.
• Post-Mortems & RCAs: Drive post-incident reviews and root cause analyses (RCAs), documenting timelines, findings, and actionable follow-ups.
• SIEM Engineering: Implement, tune, and maintain SIEM use cases, detection rules, correlation logic, and alerting to reduce false positives and close detection gaps.
• SIEM Support: Provide ongoing support for the SIEM platform, including onboarding new log sources, troubleshooting data ingestion, and maintaining dashboards/reports.
• Cross-Team Collaboration: Partner with Engineering, IT, and other Security teams to remediate findings, validate fixes, and share threat context.
• Process Improvement: Identify gaps in detection, response, and documentation, and drive improvements to playbooks, runbooks, and SOC workflows.

Skills

Incident response

Investigation

SIEM expertise

RCA & documentation

Communication

Process mindset

Linux/Unix

Tools

Splunk

Microsoft Sentinel

Elastic SIEM

QRadar

Job description

Talkdesk is seeking a SOC Engineer / Detection Engineer to detect, investigate, and respond to security incidents across our environment. You will work hands-on with our SIEM, IR processes, and serve as a liaison between the SOC and other engineering/security teams.

Responsibilities include leading incident response, conducting in-depth investigations, driving RCAs, tuning SIEM use cases, and improving SOC playbooks and runbooks.