SR Information Security Engineer

The Role

We are hiring a Security Platform & SecOps Engineer to design, build, automate, operate, and continuously improve the security platforms that power modern Managed Security Services Provider (MSSP) Security Operations Centre services.
This is a senior hands-on engineering role for someone who can take end-to-end ownership of platforms across SIEM, XDR, SOAR, security data pipelines, threat intelligence, cloud security, identity protection, exposure management, and SecOps automation.
In one sentence: Own and engineer the end-to-end MSSP security platform ecosystem to deliver scalable, automated, resilient, and measurable 24x7 SOC services.

The Main Responsibilities

Platform Architecture & Engineering

• Design and implement MSSP-grade security platform architectures for multi-customer SOC service delivery.
• Engineer unified SecOps capabilities across SIEM, XDR, SOAR, EDR, NDR, cloud security, identity security, threat intelligence, ITSM, vulnerability, and exposure management platforms.
• Develop reference architectures, integration standards, data flow diagrams, onboarding patterns, and engineering guardrails.

SIEM, Security Data Pipelines & Telemetry

• Build and maintain reliable telemetry ingestion using agents, collectors, syslog, CEF/LEEF, APIs, event hubs, forwarders, cloud connectors, custom connectors, OpenTelemetry where applicable.
• Develop parsing, normalization, schema mapping, enrichment, routing, filtering, retention, archival, and data quality controls.
• Prioritize critical security telemetry across endpoint, identity, cloud, SaaS, email, firewall, proxy, VPN, DNS, server, application, and database sources.
• Monitor ingestion health, data volume, parser quality, delayed or missing data, connector failures, duplication, query performance, and storage/licensing usage.

SOAR, Automation & AI-Assisted SecOps

• Design and implement SOAR playbooks for enrichment, triage, escalation, evidence collection, notification, reporting, and case management.
• Integrate security platforms using REST APIs, webhooks, scripts, connectors, service principals, certificates, managed identities, and secure secrets handling.
• Automate repeatable SOC workflows such as phishing triage, suspicious sign-in response, IOC enrichment, endpoint containment support, case creation, and SLA tracking.
• Apply human-in-the-loop controls for high-impact response actions 

Detection Engineering Enablement

• Work with SOC analysts, threat hunters, and detection engineers to deploy, validate, tune, and maintain detection content across SIEM, XDR, EDR, cloud, identity, and network platforms.
• Support MITRE ATT&CK-aligned detection coverage, telemetry gap analysis, threat-informed defence, and purple-team validation.
• Enable Detection-as-Code practices, including version control, peer review, testing, deployment, rollback, and reusable detection content libraries.

Platform Lifecycle, Patching & Upgrades

• Own lifecycle management for SOC platforms, endpoint agents, cloud agents, collectors, forwarders, connectors, integrations, certificates, API credentials, and supporting infrastructure.
• Plan and execute agent patching, collector upgrades, connector updates, integration maintenance, and platform version upgrades across SIEM, XDR, SOAR, EDR, NDR, CNAPP, CSPM, vulnerability, and related security platforms.
• Perform pre-upgrade assessment, compatibility checks, dependency mapping, change preparation, test planning, rollback planning, maintenance coordination, and stakeholder communication.
• Validate post-upgrade functionality for log ingestion, alert generation, dashboards, playbooks, APIs, ticketing workflows, RBAC, etc

Customer Onboarding & Service Transition

• Lead technical onboarding for new MSSP customers from discovery and design through integration, testing, acceptance, and SOC handover.
• Create onboarding plans, data flow diagrams, collector designs, integration checklists, validation test cases, runbooks, reporting requirements, and acceptance criteria.
• Work with customer IT, network, cloud, endpoint, identity, application, compliance, and vendor teams to enable required telemetry and controlled response workflows.

What We Look For in a Candidate

• 5+ years of cybersecurity engineering, security platform engineering, SOC engineering, security data engineering, or security infrastructure experience.
• 3+ years of hands-on experience designing, deploying, maintaining, or upgrading SIEM and/or SOAR platforms in an enterprise, MSSP, MDR, SOC, or security consulting environment.
• Hands-on experience with at least one major SIEM platform such as Microsoft Sentinel, Splunk, Cortex XSIAM, Google SecOps, FortiSIEM, QRadar, or equivalent.
• Hands-on experience with at least one SOAR or automation platform such as Cortex XSOAR, FortiSOAR, Splunk SOAR, Microsoft Sentinel automation, Azure Logic Apps, Google SecOps SOAR, or equivalent.
• Experience with agent deployment and patching, collector and forwarder management, connector updates, platform upgrades, change control, rollback planning, and production validation.
• Strong understanding of security telemetry across cloud, SaaS, identity, endpoint, network, application, database, and infrastructure environments.
• Working knowledge of APIs, scripting, automation, secrets handling, service principals, certificates, secure integration design, and production support practices.
• Strong troubleshooting capability across source devices, agents, collectors, network paths, parsers, ingestion pipelines, storage, dashboards, alerts, playbooks, and ticketing integrations.
• Ability to produce clear architecture diagrams, technical documentation, runbooks, onboarding artefacts, and stakeholder-ready explanations.

Preferred Certifications

• Microsoft SC-200, SC-100, AZ-500, or equivalent Microsoft security certifications.
• Splunk Admin / Architect, Palo Alto Cortex XSOAR or XSIAM, Fortinet NSE, Google SecOps, or other platform certifications.
• GIAC certifications such as GCIA, GCIH, GCFA, GDAT, GCTI, or equivalent practitioner certifications.
• CISSP, CCSP, AWS Security Specialty, or cloud/security architecture certifications.
• Training or practical experience in MITRE ATT&CK, detection engineering, threat hunting, purple teaming, cloud security, platform engineering, or DevSecOps.