Remote SOC Security Engineer — SIEM/SOAR & AWS Automation

BlockchainHQ; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Work-from-home arrangement

Competitive compensation

Career growth opportunities

Job summary

Binance is seeking a security-focused engineer to design, build, and maintain SOC platforms and tooling, emphasizing SIEM, SOAR, and automation. You will develop Python services and security integrations with AWS and internal security tools, while supporting SOC operations.

Proficiency in Python and AWS, plus SIEM experience, are required. The role involves on-call incident response and collaboration with SOC teams to enhance detection coverage and platform capabilities.

Qualifications

• Hands-on Python development experience is required.
• Experience with AWS, particularly EC2, S3, Lambda, IAM, and CloudWatch.
• Experience developing production-quality services, automation, APIs, or internal security tools.
• Practical experience using SIEM platforms for security monitoring, log analysis, and alert investigation.
• Good understanding of SOC operations and Incident Response (IR), including alert triage and security incident investigation.
• Understanding of common security threats and experience developing security detections / threat models / SIEM use cases.
• Familiarity with EDR, security telemetry, REST APIs, Git, Docker, and Linux.
• Strong problem-solving, troubleshooting, and communication skills.

Responsibilities

• Design, develop, and maintain SOC security platforms and tooling, with a primary focus on SIEM, SOAR, and security automation.
• Develop Python-based services, scripts, automation workflows, and security integrations with SIEM, EDR, AWS, and internal security platforms.
• Build and maintain AWS-based security services and integrations, including EC2, S3, Lambda, IAM, and CloudWatch.
• Support SIEM operations and detection engineering, including log ingestion, parsing, normalization, correlation, and detection rule development.
• Develop detection use cases and common security threat models, based on attack scenarios and real-world security incidents.
• Participate in SOC on-call rotation and incident response, including alert triage, investigation, containment, and post-incident analysis.
• Work with SOC analysts and security teams to improve security automation, detection coverage, and platform capabilities.

Skills

Python development

Golang

Java

AWS

SIEM

Incident Response

EDR

REST APIs

Docker

Git

Linux

Communication skills

Troubleshooting

Security automation

Tools

Docker

Git

CloudWatch

EC2

S3

Job description

Binance is seeking a security-focused engineer to design, build, and maintain SOC platforms and tooling, emphasizing SIEM, SOAR, and automation. You will develop Python services and security integrations with AWS and internal security tools, while supporting SOC operations.

Proficiency in Python and AWS, plus SIEM experience, are required. The role involves on-call incident response and collaboration with SOC teams to enhance detection coverage and platform capabilities.