SOC Detection Engineer – Incident Response & Automation

First Advantage Global operating Centre; United States; Remote; USD 110,000 - 140,000; Full time

Job summary

First Advantage Global operating Centre is seeking a Security Engineer to handle Level 2/3 SOC escalations, develop detections, and contribute to SOC engineering projects. You will analyze telemetry from endpoints, cloud, and applications, and help to build automation and response workflows.

The role emphasizes incident analysis, detection modernization, and collaboration with internal teams and providers to improve security visibility and reduce incidents.

Qualifications

• General knowledge of security operations, incident response, and attacker techniques.
• Hands-on experience with SIEM, EDR/XDR, SOAR, or comparable security technologies.
• Experience using query languages such as KQL, SPL, SQL.

Responsibilities

• Investigate and resolve Level 2 and Level 3 SOC escalations using established procedures and playbooks.
• Analyze telemetry across endpoints, identity, cloud, and networks to validate activity and document findings.
• Develop, test, deploy, and tune detections for defined use cases across SIEM, XDR, EDR, cloud, and APIs.
• Create enrichment, triage, notification, containment, and remediation workflows for Tier 1 gaps.
• Perform scoped threat hunts and retrospective searches to improve detections and telemetry.

Skills

Security operations

Incident response

Automation

Documentation

Escalation judgment

Threat hunting

Monitoring

Education

Bachelor + 2 years; Master + 0 years; PhD + 0 years; or equivalent

Tools

SIEM

EDR/XDR

SOAR

PowerShell

Python

APIs

KQL/SPL/SQL

Job description

First Advantage Global operating Centre is seeking a Security Engineer to handle Level 2/3 SOC escalations, develop detections, and contribute to SOC engineering projects. You will analyze telemetry from endpoints, cloud, and applications, and help to build automation and response workflows.

The role emphasizes incident analysis, detection modernization, and collaboration with internal teams and providers to improve security visibility and reduce incidents.