Lead SOC Detection & IR Engineer (Remote)

Warmada; Atlanta (GA); Remote; USD 160,000 - 175,000; Full time

Benefits offered by this job

Medical, dental, & vision plans

401(k) with company match

Annual bonus

Flexible PTO

Job summary

PrizePicks is seeking a seasoned SOC engineer to lead detection, incident response, and forensics with hands-on ownership over evolving the program. You’ll monitor, triage, respond, and drive improvements across the IR lifecycle.

You will own playbooks, threat hunting, and automation to reduce toil and improve response times, while maturing metrics and the overall program scope. Strong SIEM, cloud, and forensics expertise are required, with remote-ready flexibility.

Qualifications

• 5+ years in a SOC, incident response, or detection engineering role.
• Hands-on SIEM experience with log ingestion, correlation, and tuning.
• Experience with digital forensics across host and cloud environments.
• Proficiency in building automation/scripting for triage and response (Python or similar).
• Familiarity with cloud providers (AWS/GCP/Azure) and MITRE ATT&CK.

Responsibilities

• Own Detection & Monitoring: fine-tune SIEM detection content and reduce false positives.
• Build incident response playbooks for repeatable, consistent actions.
• Lead threat hunting to catch malicious or anomalous activity.
• Strengthen digital forensics capabilities and evidence handling.
• Automate alerting, enrichment, and triage to reduce toil.
• Respond to incidents, coordinating with business partners as needed.
• Document incidents, root cause, and remediation clearly.
• Lead post-incident reviews with blameless analysis and action tracking.
• Shape IR metrics and escalation paths as the program matures.

Skills

Python scripting

Incident response

Threat hunting

Cloud computing

Communication

Education

Security certifications (GCIH/GCFA/GCIA/OSCP)

Tools

SIEM tooling

Job description

PrizePicks is seeking a seasoned SOC engineer to lead detection, incident response, and forensics with hands-on ownership over evolving the program. You’ll monitor, triage, respond, and drive improvements across the IR lifecycle.

You will own playbooks, threat hunting, and automation to reduce toil and improve response times, while maturing metrics and the overall program scope. Strong SIEM, cloud, and forensics expertise are required, with remote-ready flexibility.