SOC Engineer - Detection & Platform Automation

Merlin Group; McLean (VA); On-site; USD 120,000 - 150,000; Full time

Benefits offered by this job

On-site gym & wellness benefits

401(k) with employer match

Job summary

Merlin Group in McLean, VA is seeking a SOC Engineer to design, build, and operate the security operations platform with a focus on automation and detection engineering. You will partner with SOC analysts to develop reliable detections, workflows, and infrastructure that scale as needs grow.

You will collaborate with the SOC Manager, Engineering, Infrastructure, and GRC teams to maintain security, compliance, and scalable operation of the SOC tooling.

Qualifications

• 4+ years of experience in SOC-related roles.
• Deep hands-on experience with Splunk, SPL, CIM, and Enterprise Security.
• Experience with SOAR platforms and REST/webhooks integration.
• Proficiency in at least one scripting language and Git-based CI/CD.
• Working knowledge of AWS security services and Terraform.
• Experience with ITSM platforms (ServiceNow preferred).

Responsibilities

• Design, build, and tune detections in Splunk, mapping coverage to MITRE ATT&CK and managing rules with version control and peer review.
• Onboard and maintain log sources across AWS, Azure, and GCP with forwarders and retention controls for FedRAMP audit logging.
• Build and maintain Torq workflows for alert enrichment, triage, containment, and case handling, integrating with Splunk, ServiceNow, cloud APIs, and other SOC tools.
• Engineer and operate the SOC platform in AWS, including IaC, deployment pipelines, IAM, secrets management, and monitoring.
• Produce and maintain runbooks and architecture diagrams for detections and automation.
• Serve as engineering escalation point during incidents and participate in on-call rotations.

Skills

SOC engineering

Detection engineering

Automation

Scripting

CI/CD

Git workflows

Tools

Splunk

Torq

ServiceNow

AWS

Terraform

REST APIs

Job description

Merlin Group in McLean, VA is seeking a SOC Engineer to design, build, and operate the security operations platform with a focus on automation and detection engineering. You will partner with SOC analysts to develop reliable detections, workflows, and infrastructure that scale as needs grow.

You will collaborate with the SOC Manager, Engineering, Infrastructure, and GRC teams to maintain security, compliance, and scalable operation of the SOC tooling.