Senior SOC Detection Engineer - Build Threat Detection

Softswiss; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Private health insurance

Sports benefits

Free English lessons (online)

Local language courses

Paid time off

Maternity leave support

Referral program rewards

Upskilling, internal workshops, and...

Job summary

SOFTSWISS is seeking a Senior SOC Detection Engineer to join the Security Operations team. You will own the full lifecycle of detections in Splunk, from researching attack techniques to deploying and tuning content that reduces false positives and improves threat visibility.

You will work across Windows, Linux, and Kubernetes environments, collaborating with SOC, IR, Threat Intelligence, and Infra teams to elevate detection coverage and incident response readiness.

Qualifications

• Hands-on SOC experience in detection engineering, threat hunting, or IR.
• Strong knowledge of MITRE ATT&CK techniques and detection methods.
• Proficiency in Splunk SPL and building detections, dashboards, and reports.
• Experience tuning detections, handling exceptions, and allowlists.
• Ability to define logging and telemetry requirements.
• Scripting in Python, PowerShell, or Bash for automation.

Responsibilities

• Own the lifecycle of detections from research to deployment in Splunk.
• Translate investigations into effective detections and rules.
• Analyze false positives/negatives and close detection gaps.
• Map detections to MITRE ATT&CK techniques and improve telemetry.
• Develop SPL queries, dashboards, and risk-based detections.
• Collaborate with SOC, IR, Threat Intel, and Engineering teams.
• Document logic, data sources, and dependencies; support CI/CD workflows.

Skills

SOC Detection

Threat Hunting

Incident Response

Splunk SPL

Python

PowerShell

Bash

Git

CI/CD

MITRE ATT&CK

Tools

Splunk Enterprise Security

Kubernetes

Job description

SOFTSWISS is seeking a Senior SOC Detection Engineer to join the Security Operations team. You will own the full lifecycle of detections in Splunk, from researching attack techniques to deploying and tuning content that reduces false positives and improves threat visibility.

You will work across Windows, Linux, and Kubernetes environments, collaborating with SOC, IR, Threat Intelligence, and Infra teams to elevate detection coverage and incident response readiness.