Senior SOC Detection Engineer — Build Global Detections

Embedded Shishya; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Private health insurance

Sports benefits

Mental Health Program

Free English lessons (online)

Local language courses

Paid time off

Maternity leave support

Referral program rewards

Upskilling and conferences

Job summary

SOFTSWISS is seeking a Senior SOC Detection Engineer to own the full lifecycle of detections across Windows, Linux, and Kubernetes environments. You will research attack techniques, define logging requirements, and build, test, deploy, and continuously improve detection content in Splunk.

You will translate investigations into detections, optimize telemetry, reduce false positives, and collaborate with SOC, IR, Threat Intelligence, and Engineering teams to strengthen overall security posture.

Qualifications

• Hands-on SOC/detection engineering experience.
• Deep knowledge of MITRE ATT&CK and detection methods.
• Proficiency in Splunk SPL or similar SIEM.
• Experience building detections, queries, dashboards, and reports.
• Automation scripting in Python/PowerShell/Bash.
• Experience with Git, APIs, and CI/CD basics.
• Understanding of Windows and Linux security monitoring.

Responsibilities

• Develop, test, deploy, and maintain detection and correlation rules in Splunk or a similar SIEM.
• Translate incident investigations, threat hunting, and attack research into detections.
• Analyze false positives/negatives and detection gaps.
• Improve detection coverage and map detections to MITRE ATT&CK techniques.
• Develop SPL queries, dashboards, reports, and risk-based detections.
• Define logging, parsing, normalization, enrichment, and data quality requirements.
• Develop monitoring and health checks for detection rules and data sources.
• Contribute to automated detection testing, synthetic events, and CI/CD workflows.
• Participate in incident investigations, threat hunting, purple team exercises, and attack emulation.
• Collaborate with SOC, IR, Threat Intelligence, Infrastructure, and Engineering teams.
• Document detection logic, data sources, dependencies, limitations, and expected behavior.

Skills

Threat hunting

Incident response

Detection engineering

Python

PowerShell

Bash

Git

CI/CD basics

Windows security monitoring

Tools

Splunk SPL

Kubernetes

Docker

Sysmon

Active Directory

Git

CI/CD tooling

Job description

SOFTSWISS is seeking a Senior SOC Detection Engineer to own the full lifecycle of detections across Windows, Linux, and Kubernetes environments. You will research attack techniques, define logging requirements, and build, test, deploy, and continuously improve detection content in Splunk.

You will translate investigations into detections, optimize telemetry, reduce false positives, and collaborate with SOC, IR, Threat Intelligence, and Engineering teams to strengthen overall security posture.