About this role
The SOC (Security Operations Center) team is responsible for monitoring and responding to security incidents across the company’s infrastructure. The team analyzes alerts, investigates suspicious activity, and maintains detection rules, response runbooks, and SIEM tools (including Splunk). They also improve detection capabilities, conduct threat hunting, and collaborate with engineering teams to strengthen security monitoring across Linux systems, cloud environments, and microservices. Act as the L3 escalation point for complex security incidents and lead advanced investigations. Design and mature SOC processes, operational metrics, and contribute to the overall SOC architecture and detection strategy. Design, implement, and improve SIEM detection rules and response playbooks using a Detection as Code (DaC) approach. Translate MITRE ATT&CK tactics into practical detection logic across Linux, Cloud (AWS/GCP), and microservices environments. Drive hypothesis-based threat hunting activities to identify sophisticated, hidden attacker behavior. Collaborate with cross-functional and platform teams to streamline SOC workflows, improve alert enrichment, and enhance security visibility.