SOC Engineer - Detections, Automation | Unlimited PTO

Merlin International Inc; McLean (VA); On-site; USD 110,000 - 140,000; Full time

Job summary

Merlin Group in McLean, VA seeks a SOC Engineer to build and improve security operations capabilities, with a strong focus on automation and detection engineering. You will work with SOC analysts, IAM, Cloud logs, and incident response workflows to strengthen the platform.

Join a fast-paced cybersecurity team delivering mission-critical solutions across federal and commercial markets, leveraging Splunk, Terraform, and ServiceNow integrations in an on-site role.

Qualifications

• 4+ years of experience in SOC engineering, detection engineering, or a related role.
• Hands-on Splunk experience: SPL, CIM, data models, Enterprise Security.
• Automation with SOAR (Torq preferred) and REST APIs/webhooks.
• Proficiency in at least one scripting language; comfortable with Git-based CI/CD.
• Working knowledge of AWS security services and Terraform IaC.
• Experience with ITSM platforms (ServiceNow preferred).

Responsibilities

• Design, build, and tune detections in Splunk using SPL and ATT&CK mapping.
• Onboard and maintain log sources across AWS, Azure, GCP with FedRAMP considerations.
• Build Torq workflows for alert enrichment, triage, and case handling with ServiceNow.
• Operate SOC tooling in AWS; manage IaC, deployment pipelines, IAM, secrets, monitoring.
• Produce runbooks and diagrams; provide evidence for audits and control assessments.
• Serve as engineering escalation during incidents and participate in on-call rotation.

Skills

SOC engineering

Splunk SPL

SOAR automation

APIs & webhooks

Scripting

Git CI/CD

AWS security

Terraform / IaC

ITSM ServiceNow

Tools

Splunk

Torq

ServiceNow

Git

Terraform

Job description

Merlin Group in McLean, VA seeks a SOC Engineer to build and improve security operations capabilities, with a strong focus on automation and detection engineering. You will work with SOC analysts, IAM, Cloud logs, and incident response workflows to strengthen the platform.

Join a fast-paced cybersecurity team delivering mission-critical solutions across federal and commercial markets, leveraging Splunk, Terraform, and ServiceNow integrations in an on-site role.