Senior SOC Security Engineer - Detection & Automation Lead

EXOS; Indianapolis (IN); On-site; USD 100,000 - 140,000; Full time

Job summary

EXOS is seeking a Cybersecurity Engineer to own and maintain the SOC security stack across multiple client environments. You will deploy, upgrade, and integrate tools, measure protection, and provide clear recommendations for improvement.

This hands-on role requires 5+ years in security or infra engineering and the ability to run a multi-tenant stack at scale. You will tune detections, coordinate with SOC analysts, and drive changes through controlled processes while maintaining documentation

Qualifications

• 5+ years in IT or security, including 3+ years engineering or administering security platforms such as EDR, SIEM, XDR, SOAR, firewalls, IPS, Web Proxies, email security, etc.
• Administration of DNS-layer and email security platforms such as Cisco Umbrella, DNSFilter, and Avanan.
• Solid networking fundamentals, including TCP/IP, routing, switching, VLANs, DNS, DHCP, and proxy concepts.
• Working knowledge of Windows Server, Active Directory, Entra ID, Microsoft 365, and Linux administration.
• Scripting in PowerShell and/or Python, and comfort working with REST APIs.
• Experience running change management, testing, and documentation for production security systems.
• The ability to assess a control environment, spot gaps, and write clear recommendations with priority, effort, and business impact.
• Clear communication with analysts, managers, and client IT teams, including written change notices and post-change summaries.
• Relevant certifications such as CompTIA Security+, CySA+, Cisco CCNA, or equivalent experience.

Responsibilities

• Own administration and health of the SOC security stack, including security tools like SentinelOne, CrowdStrike, Splunk, Cisco Firepower, Cisco ASA, Cisco Umbrella, DNSFilter, Avanan, and our security awareness training platform.
• Plan and deliver platform updates, agent upgrades, policy changes, and version lifecycles across client tenants. Every change goes through change control with testing, a maintenance window, and a rollback plan.
• Deploy and onboard security tooling for new clients, including agent rollout, log source integration, policy baselines, and handoff documentation for the SOC.
• Onboard log sources, maintain parsing and field extractions, monitor for stalled or missing sources, and keep license and storage use on target.
• Build, tune, and maintain detections and correlation searches with the SOC analysts. Reduce false positive load and close coverage gaps mapped to MITRE ATT&CK.
• Maintain perimeter and DNS security posture. Review Cisco Firepower and ASA rule sets, IPS policies, and VPN configurations, and manage Cisco Umbrella and DNSFilter policies across tenants.
• Support phishing simulations and training campaigns in the security awareness platform.
• Identify gaps across people, process, and technology. Run regular coverage reviews for agent deployment, log sources, and policy drift, benchmark against CIS Controls and NIST CSF, and present prioritized recommendations to the Security Operations Manager.
• Evaluate new tools and features. Run proofs of concept, compare vendors, manage vendor support cases, and build business cases that weigh risk reduction, operational effort, and cost.
• Automate repetitive work with PowerShell, Python, and platform APIs, and partner with the AI Automation Engineer on SOAR playbooks and integrations.
• Support analysts during incidents with containment actions, emergency blocks, and tooling troubleshooting, and take part in the after-hours escalation rotation.
• Keep engineering documentation current, including architecture diagrams, configuration standards, tool runbooks, and client-specific deployment notes.

Skills

Security engineering

Security platforms

DNS security

Networking fundamentals

Windows & Linux admin

Scripting (PowerShell/Python)

REST APIs

Change management

Clear communication

Security certifications

Education

Bachelor’s degree in Cybersecurity/IT/CS

Tools

Splunk

CrowdStrike

SentinelOne

Cisco Firepower/ASA

Cisco Umbrella

DNSFilter

Avanan

Job description

EXOS is seeking a Cybersecurity Engineer to own and maintain the SOC security stack across multiple client environments. You will deploy, upgrade, and integrate tools, measure protection, and provide clear recommendations for improvement.

This hands-on role requires 5+ years in security or infra engineering and the ability to run a multi-tenant stack at scale. You will tune detections, coordinate with SOC analysts, and drive changes through controlled processes while maintaining documentation