SOC Detection Engineer: Incident Response & SIEM Expert

Talkdesk; Portugal; Hybrid; EUR 50,000 - 80,000; Full time

Job summary

Talkdesk is seeking a SOC Engineer / Detection Engineer to detect, investigate, and respond to security incidents across our environment. You will work hands-on with our SIEM and incident response processes, acting as a bridge between SOC and security teams.

Responsibilities include incident response leadership, deep investigations across logs and cloud sources, and driving improvements to detection, playbooks, and RCAs.

Qualifications

• Experience handling security incidents with triage, containment, and coordination.
• Strong analytics to investigate alerts and logs to determine root cause.
• Practical experience implementing and tuning SIEM detection rules.
• Proven ability to write post-mortems, RCAs, and incident reports for technical and non-technical audiences.
• Ability to work cross-functionally with engineering and security teams.
• Track record of identifying and driving improvements to SOC processes.
• Linux/Unix proficiency and comfort with AWS log sources.

Responsibilities

• Lead and support end-to-end incident response.
• Investigate suspicious activity across logs, endpoints, network, and cloud.
• Drive post-incident reviews and RCAs with actionable follow-ups.
• Implement, tune, and maintain SIEM use cases and detection rules.
• Provide ongoing SIEM support, onboarding new log sources, dashboards.
• Collaborate with cross-team to remediate findings and validate fixes.
• Improve playbooks and SOC workflows.

Skills

Incident Response

Investigation Skills

SIEM Expertise

RCA & Documentation

Communication

Process Mindset

Linux/Unix proficiency

Tools

Splunk

Elastic

QRadar

Sentinel

Python

Job description

Talkdesk is seeking a SOC Engineer / Detection Engineer to detect, investigate, and respond to security incidents across our environment. You will work hands-on with our SIEM and incident response processes, acting as a bridge between SOC and security teams.

Responsibilities include incident response leadership, deep investigations across logs and cloud sources, and driving improvements to detection, playbooks, and RCAs.