SOC Engineer

TENEX.AI; United States; On-site; USD 100,000 - 130,000; Full time

Job summary

TENEX.AI is looking for a SOC Engineer who will be responsible for incident response and operational improvements. You will evaluate telemetry coverage, lead high-severity incidents, and work directly with engineering teams to enhance automation and tooling.

The ideal candidate has over 5 years in security operations and a solid understanding of logging and cloud security. Relevant certifications and communication skills across audiences are also essential. Join us to tackle challenging security problems!

Qualifications

• 5+ years in security operations, incident response, or detection engineering.
• Strong fluency in logging and telemetry.
• Hands-on experience with SIEM platforms like Google Chronicle or Splunk.
• Solid understanding of response automation and SOAR playbooks.
• Working knowledge of cloud security architecture in AWS, Azure, or GCP.
• Scripting proficiency in Python or PowerShell.
• Familiarity with AI or LLM-based security workflows.

Responsibilities

• Handle complex incident response and escalation.
• Assess and improve telemetry and logging coverage.
• Ensure SIEM and detection quality.
• Contribute to response automation quality.
• Support technical needs across the organization.
• Improve SOC tooling and operational workflows.

Job description

About the Role

As a SOC Engineer, you'll operate across incident response, platform quality, and operational improvement — evaluating telemetry coverage, shaping response automation, handling high‑severity escalations, and ensuring the tooling and workflows analysts depend on are fit for purpose. The role carries direct engagement across internal engineering teams and customers, and no shortage of hard problems to solve. We default to automation and AI wherever they produce better outcomes — and we want engineers who think the same way.

What You'll Do

• Handle complex incident response and escalation. Take ownership of high‑severity and technically complex incidents — leading investigation, driving containment decisions, and communicating findings clearly when it counts.
• Assess and improve telemetry and logging coverage. Automate evaluation of customer environments for logging gaps and deficiencies across endpoint, network, identity, and cloud. Specify what's needed for effective detection and investigation, and work with customers and internal teams to close the gaps.
• Ensure SIEM and detection quality. Apply deep platform knowledge to evaluate detection fidelity, data normalization, parser quality, and alert logic — identifying where coverage or quality falls short and partnering with detection engineering to address it.
• Contribute to response automation quality. Work closely with the SOAR team to review enrichment logic, containment playbooks, and automation design — bringing an incident responder's perspective to what works under pressure and what doesn't.
• Support technical needs across the organization. Serve as a knowledgeable resource for forward‑deployed engineers, onboarding teams, and customers on questions spanning telemetry, investigation, platform behavior, and response — representing the SOC's technical depth across functions.
• Improve SOC tooling and operational workflows. Identify friction in how analysts triage, investigate, and respond. Partner on tooling improvements, process changes, and reference content that raise consistency and quality across the team.

What You Bring

• 5+ years in security operations, incident response, or detection engineering with demonstrated depth across multiple domains.
• Strong fluency in logging and telemetry — able to evaluate an environment's coverage posture, identify deficiencies, and articulate what's needed for effective detection and investigation.
• Hands‑on experience with SIEM platforms (Google Chronicle, Microsoft Sentinel, and/or Splunk a plus) — enough to understand data modeling, rule architecture, and parser quality, and recognize when a deployment falls short of what our MDR SOC requires.
• Solid understanding of response automation — enrichment pipelines, SOAR playbook structure, containment logic — and the judgment to evaluate whether automation is working as intended.
• Working knowledge of cloud security architecture in at least one major cloud (AWS, Azure, or GCP), including native log sources and their value for investigation.
• Scripting proficiency in Python or PowerShell for automation support, and integration work.
• Familiarity applying AI or LLM‑based tooling to security workflows — investigation assistance, alert triage, log analysis, or automation — is a strong plus.
• Clear, confident communicator across technical and non‑technical audiences — customers, engineers, and analysts alike.

Bonus Points

• Multi‑cloud breadth across AWS, Azure, and GCP security tooling and telemetry.
• Experience with IaC (Terraform, CloudFormation) and DevSecOps practices.
• Familiarity authoring detection runbooks, investigation guides, or SOC operating procedures.
• Splunk Enterprise Security depth — ES notable events, risk‑based alerting, correlation search architecture.
• Container and Kubernetes security monitoring exposure.
• Experience building or evaluating AI‑assisted security tooling, agentic workflows, or LLM‑augmented investigation and response.

Education & Certifications

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent work experience.
• Relevant certifications — CISSP, GCIH, GCFE, GCDA, GREM, AWS/GCP security, or SIEM platform certifications — are a plus.