Senior Security Operations & Detection Engineer

Socket.dev; Austin (TX); On-site; USD 120,000 - 150,000; Full time

Job summary

ASSYST is seeking an experienced Network Security Analyst II to support enterprise security operations across network, endpoint, cloud, and on-premises environments.

The candidate will monitor, detect, investigate, and respond to security events, with hands-on work in SIEM, SOAR, EDR/XDR, and NDR. Strong KQL/SPL skills and threat intelligence are required, along with collaboration with cross-functional teams for risk mitigation.

Qualifications

• 7+ years in cybersecurity, network security, security operations, incident response, or related roles.
• 7+ years with SIEM, SOAR, EDR, XDR, and NDR technologies.
• Experience with security log collection and SIEM architecture support.
• Threat intelligence and detection engineering experience.
• Hands-on with Microsoft Sentinel analytics rules, workbooks, automation, data connectors, incident management, and KQL.
• Experience with NDR and traffic analysis, endpoint investigation, and response actions.
• Knowledge of firewall, IDS/IPS, DNS, VPN, TCP/IP, and secure network architecture.
• Familiarity with NIST/CIS controls, HIPAA, and security requirements.
• Strong analytical, communication, and documentation skills.
• Bachelor’s degree preferred.

Responsibilities

• Monitor and analyze security alerts, logs, traffic, and threat intel feeds.
• Perform incident triage, investigation, escalation, containment, and documentation.
• Investigate suspicious activity, malware indicators, and anomalous network behavior.
• Develop and tune SIEM rules, alerts, dashboards, queries, and playbooks.
• Conduct threat hunting using KQL, SPL, and telemetry.
• Support vulnerability, risk, and security control assessments.
• Analyze and correlate events across network, endpoints, identity, and cloud.
• Coordinate with teams to validate incidents and implement risk mitigation.
• Identify IOCs and attacker tactics, and prepare incident reports.

Skills

SIEM/SOAR/XDR

Threat hunting

KQL

Incident response

Network security

Endpoint security

Cloud security

Detection engineering

Malware analysis

TLS/IDS/IPS

Education

Bachelor’s degree in Cybersecurity or related field

Tools

Microsoft Sentinel

Splunk

EDR/XDR tools

Job description

ASSYST is seeking an experienced Network Security Analyst II to support enterprise security operations across network, endpoint, cloud, and on-premises environments.

The candidate will monitor, detect, investigate, and respond to security events, with hands-on work in SIEM, SOAR, EDR/XDR, and NDR. Strong KQL/SPL skills and threat intelligence are required, along with collaboration with cross-functional teams for risk mitigation.