Principal Engineer - SOC Analyst

Job Summary:

We are seeking a highly skilled and motivated SOC Analyst / Detection Engineer to join our Security Operations Center. This role requires expertise in developing advanced KQL and Splunk queries, detection engineering, and incident response within complex enterprise environments. The ideal candidate will bring hands-on experience with SIEM, EDR, cloud security, incident playbooks, and OSINT tools, while also showing a passion for mentoring junior team members.

Key Responsibilities:

• Develop and fine-tune detection rules and analytics using KQL (Microsoft Sentinel) and SPL (Splunk).
• Lead threat hunting activities leveraging EDR telemetry, SIEM logs, and threat intelligence sources.
• Design and implement detections based on behavioral patterns and MITRE ATT&CK mappings.
• Investigate security alerts and incidents, triage threats, and provide detailed incident reports and root cause analysis.
• Build and maintain incident response playbooks, SOPs, and runbooks to streamline SOC operations.
• Collaborate with internal teams to continuously improve detection logic and incident workflows.
• Mentor and train junior analysts, promote knowledge sharing, and support SOC skill development.
• Develop integrations and use cases with various log sources from on-prem, cloud, and hybrid environments.
• Utilize OSINT tools and frameworks (e.g., VirusTotal, Shodan, Censys, MISP, AbuseIPDB, Whois, etc.) during threat investigation and enrichment.
• Drive automation and orchestration where applicable using SOAR technologies.
• Stay up to date on threat intelligence, emerging tactics, techniques, and procedures (TTPs).

Technical Skill Requirements:

• Detection Engineering: Strong expertise in writing detection queries (KQL/SPL), developing use cases, and tuning alerts.
• SIEM: Hands-on experience with Microsoft Sentinel and Splunk (Enterprise Security).
• EDR/XDR: CrowdStrike Falcon, Microsoft Defender for Endpoint.
• Cloud Security: Security monitoring in Azure, AWS, and GCP.
• Microsoft 365 Security: Defender for Office 365, Entra ID (Azure AD), Purview (compliance).
• Web Security Filtering: Experience or knowledge of Zscaler and similar solutions.
• Incident Response: Playbook development, SOPs, runbook creation, triage, and remediation.
• OSINT Tools: Practical usage of VirusTotal, URLScan.io, MISP, Shodan, Censys, GreyNoise, AbuseIPDB, Whois, etc.
• Log Analysis: Deep understanding of log formats from servers, network devices, cloud services, and applications.
• Automation/SOAR: Familiarity with automation frameworks (Logic Apps, Sentinel Playbooks, Splunk SOAR) is a plus.
• Scripting: PowerShell, Python, or equivalent scripting for enrichment and automation.

Additional Expectations:

• Willingness to mentor and train junior SOC team members.
• Ability to work independently in a fast-paced SOC environment.
• Excellent analytical, communication, and problem-solving skills.
• Strong attention to detail and a proactive security mindset.

Preferred Certifications (Nice to Have):

• SC-200: Microsoft Security Operations Analyst
• Splunk Core/Enterprise Security certifications
• CrowdStrike CCFR / CCFH
• Zscaler ZCCA/ZCCP
• Azure/AWS/GCP security certifications
• GIAC (GCIA, GCED, GCIH) or other relevant SANS certifications