Middle SOC Security Engineer

UnderDefense; United States; Remote; USD 90,000 - 130,000; Full time

Job summary

UnderDefense Inc. is seeking a Middle SOC Security Engineer to join our MDR Engineering team.

The role focuses on configuring, maintaining, and improving security monitoring infrastructures across client environments with hands-on SIEM experience. The candidate should be comfortable with Elastic Security, Splunk, or Microsoft Sentinel, and be able to integrate diverse log sources, develop parsers, and craft detection rules.

Qualifications

• Hands-on experience with at least one SIEM platform (Elastic, Splunk, or Microsoft Sentinel).
• Experience with log collection, processing, analysis, or security integrations.
• Understanding of Windows, Linux, networking fundamentals, and common protocols.
• Familiarity with Syslog, APIs, JSON, and log formats.
• Experience writing SIEM queries and working with detection/correlation rules.
• Understanding of EDR/XDR technologies and their role in security monitoring.
• Strong troubleshooting and analytical problem-solving skills.
• Basic scripting in Bash, Python, or PowerShell.
• Ability to investigate issues independently and own tasks.
• Willingness to learn new technologies and adapt to client environments.
• English communication skills for direct client discussions.

Responsibilities

• Configure, maintain, and troubleshoot SIEM platforms (Elastic Security, Splunk, Microsoft Sentinel).
• Integrate log sources from Windows, Linux, networks, cloud services, Microsoft 365, and EDR/XDR solutions.
• Configure log collection via agents, connectors, APIs, and Syslog.
• Develop and maintain parsers for log sources and optimize detection rules.
• Maintain SIEM indexes and log ingestion volumes; manage retention policies.
• Support onboarding of new clients and ensure proper SOC monitoring integration.
• Collaborate with engineers to automate tasks and improve processes.

Skills

SIEM experience

Log collection

Windows/Linux

Scripting

EDR/XDR knowledge

Troubleshooting

English

Tools

Elastic Stack

Splunk

Microsoft Sentinel

CrowdStrike

Job description

SOC Engineer

Position Summary:

We have an exciting opportunity to join our team as a Middle SOC Security Engineer. UnderDefense is looking for a motivated and proactive engineer to join our MDR Engineering team. This role focuses on configuring, maintaining, and improving security monitoring infrastructure across multiple client environments. The ideal candidate has hands‑on experience with at least one SIEM platform, a solid understanding of security technologies, and a willingness to learn new tools and approaches. We value engineers who take ownership of technical challenges, work independently, and collaborate with the team to deliver effective solutions for our clients.

Job Responsibilities:

• Configure, maintain, and troubleshoot SIEM platforms, including Elastic Security, Splunk, Microsoft Sentinel, and other solutions depending on client environments.
• Integrate log sources from Windows, Linux, network devices, cloud services, Microsoft 365, and EDR/XDR solutions.
• Configure and maintain log collection through agents, connectors, APIs, and Syslog.
• Troubleshoot log ingestion, parsing, indexing, and integration issues.
• Develop and maintain parsers for different log sources.
• Create, test, and optimize detection and correlation rules to improve threat detection and reduce false positives.
• Configure SIEM indexes, retention policies, and manage log ingestion volumes.
• Maintain integrations between SIEM/EDR/XDR solutions and the MAXI platform.
• Support technical onboarding of new clients and ensure proper integration into SOC monitoring.
• Monitor the health and performance of existing security solutions.
• Investigate technical issues, identify root causes, and implement effective solutions.
• Communicate directly with clients’ IT and security teams to understand technical requirements, discuss challenges, and provide solutions.
• Prepare technical documentation, configuration guides, and troubleshooting instructions.
• Collaborate with other engineers to improve existing processes, automate repetitive tasks, and support the scalability of MDR services.

Minimum Qualifications:

• Hands‑on experience with at least one SIEM platform, preferably Elastic Security, Splunk, Microsoft Sentinel, or a similar solution.
• Practical experience with log collection, processing, analysis, or security integrations.
• Understanding of Windows, Linux, networking fundamentals, and common network protocols.
• Familiarity with Syslog, APIs, JSON, and log formats.
• Experience writing SIEM queries and working with detection or correlation rules.
• Understanding of EDR/XDR technologies and their role in security monitoring.
• Strong troubleshooting and analytical problem‑solving skills.
• Basic scripting skills in Bash, Python, or PowerShell.
• Ability to independently investigate technical issues, take ownership of tasks, and deliver results.
• Willingness to learn new technologies and adapt to different security platforms and client environments.
• English communication skills sufficient to discuss technical issues and solutions directly with clients.

Nice to Have:

• Previous experience in a SOC, MDR, or MSSP environment.
• Hands‑on experience with Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent).
• Experience with CrowdStrike, SentinelOne, or Microsoft Defender.
• Familiarity with AWS, Azure, or GCP.
• Experience configuring SIEM environments or integrating log sources from scratch.
• Experience with Git and automating repetitive engineering tasks.
• Experience supporting multiple client environments.

The UnderDefense Mission Is Rooted in Values That Drive Us:

• We believe that success lies in execution, not credentials.
• We act like owners, not just employees.
• We work to find answers on our own, not wait for them to be given to us.
• We optimize for mission, not ego.
• We take responsibility for solving problems, even when they involve unfamiliar technologies.
• We have growth mindsets, not fixed ones.

About this position

Location: Remote

Employment type: Full time

Department: SOC