Security Operations Engineer

Responsibilities

• 1. Security Operations
• The engineer owns the full lifecycle of security detection and response inside the SOC, from signal design through to automated containment. This is the primary domain of the role.
• Alert design and coverage
• Design and maintain SIEM detection rules covering cloud, container, identity, and application layers, using both signature-based and behavioural logic
• Map detection coverage against the MITRE ATT&CK framework and identify gaps relevant to the organisation's AWS and EKS attack surface
• Integrate threat intelligence feeds to refresh rule logic for emerging threats and TTPs
• Maintain a detection backlog, prioritised by risk, with defined review cadences
• Alert triage
• Daily SIEM alert triage following defined response timing standard
• Classify, investigate, and resolve security signals

Languages