Senior SOC Engineer: Detection & Automation Specialist

Constellation GovCloud; McLean (VA); On-site; USD 120,000 - 170,000; Full time

Benefits offered by this job

On-site gym

Medical, dental, and vision insurance

FSA and EAP

401(k) with employer match

Unlimited PTO

Job summary

Merlin Group in McLean, VA is seeking a SOC Engineer to build and improve security operations. You will partner with SOC analysts to turn needs into detections, workflows, and infrastructure, and collaborate with SOC Manager and IT teams to keep the platform secure and scalable.

The role emphasizes security automation, detection engineering, and platform engineering across AWS, Azure, and GCP, with on-call rotation and incident escalation.

Qualifications

• 4+ years of experience in SOC engineering or related security roles.
• Hands-on Splunk experience (SPL, CIM, ES).
• Automation with SOAR (Torq preferred) and API/webhook integration.
• Proficiency in a scripting language and Git-based CI/CD workflows.
• Knowledge of AWS security services (IAM, CloudTrail, GuardDuty, Security Hub) and Terraform.
• Experience with ITSM platforms (ServiceNow preferred).

Responsibilities

• Design, implement, and tune detections in Splunk with detectors and mapping to MITRE ATT&CK.
• Onboard and maintain log sources across AWS, Azure, and GCP with FedRAMP-ready controls.
• Build Torq workflows for alert enrichment, triage, containment, and case handling.
• Engineer and operate the SOC tooling platform in AWS with IaC and CI/CD pipelines.
• Produce runbooks and architecture diagrams for detections and automation.
• Serve as engineering escalation during incidents and participate in on-call rotations.

Skills

SOC engineering

Splunk

SOAR automation

Scripting language

AWS security services

ITSM/ServiceNow

Tools

Torq

Terraform

ServiceNow

Job description

Merlin Group in McLean, VA is seeking a SOC Engineer to build and improve security operations. You will partner with SOC analysts to turn needs into detections, workflows, and infrastructure, and collaborate with SOC Manager and IT teams to keep the platform secure and scalable.

The role emphasizes security automation, detection engineering, and platform engineering across AWS, Azure, and GCP, with on-call rotation and incident escalation.