Senior Security Engineer, Detection & Response (SOC)

Role overview Help build and mature a security operations capability spanning detection, incident response, threat hunting, and digital forensics. This hands-on role combines leading investigations with improving the systems, playbooks, automation, and measures that help a security team respond consistently as it scales.

Responsibilities - Monitor and triage SIEM alerts, improve detection content, reduce false positives, and identify gaps in coverage. - Develop incident response playbooks and lead threat hunts for suspicious activity that automated detections may miss. - Improve forensic investigation processes and tools, including evidence handling across host and cloud environments. - Automate alert enrichment and triage workflows, and lead incident response in coordination with business partners. - Record incidents, causes, and remediation; run blameless reviews and track follow-up actions to completion. - Evolve incident response metrics, escalation paths, and program priorities.

Requirements - At least five years in SOC, incident response, or detection engineering, with ownership of a monitoring or response program beyond queue work. - Experience building or substantially maturing a SOC or incident response function. - Strong understanding of the incident response lifecycle, from preparation and detection through recovery and lessons learned. - Hands-on SIEM experience with log ingestion, correlation, detection development, and alert tuning. - Forensic analysis and evidence handling skills, plus scripting ability in Python or a similar language. - Working knowledge of a major cloud provider, MITRE ATT&CK, common attacker techniques, and how to explain risk in business terms. - Clear written communication for playbooks and incident records.

Nice to have - Incident response, forensics, or security certifications; SOAR experience; or work in fintech, gaming, or another high-fraud-risk sector. - Experience handling detection and response for distributed teams using endpoint and identity signals.

Benefits and work setup - Remote candidates may be considered across the United States; Atlanta is preferred. The listed salary range is $160,000–$175,000, with pay depending on location, skills, experience, and education. - Benefits include subsidized medical, dental, and vision coverage; a matched 401(k); annual bonus; flexible paid time off; paid parental leave and disability benefits; workplace flexibility; equipment; and career development opportunities. - Applicants must already be authorized to work in the United States; visa sponsorship is unavailable.