Note: The job is a remote job and is open to candidates in USA. TalentFish is recruiting a Security Engineer specializing in SOAR, SIEM, and threat detection for a full-time, fully remote opportunity. The role focuses on engineering SOC threat-detection capabilities, developing SIEM detection rules and SOAR playbooks, automating security operations with Python and APIs, and supporting incident response and threat hunting.
Responsibilities
- Engineer and improve SOC threat-detection capabilities across a large enterprise environment
- Identify gaps in security visibility and determine which logs and telemetry are needed to detect specific threats
- Develop, tune, test, and maintain SIEM detection rules, correlation logic, and threat-detection use cases
- Design and develop SOAR playbooks to automate investigation, enrichment, triage, containment, escalation, and response
- Use Python, APIs, and scripting to automate security operations and integrate security platforms
- Onboard, parse, normalize, enrich, and troubleshoot security log sources
- Work with telemetry from endpoints, identity systems, networks, servers, applications, cloud platforms, email, and security technologies
- Translate attacker behaviors and common cyber threats into actionable detection logic
- Support incident response, threat hunting, malware investigations, and digital forensics
- Identify false positives, detection gaps, and opportunities to improve SOC visibility and response
- Partner closely with SOC analysts to understand investigative challenges and engineer better solutions
- Integrate SIEM/SOAR with EDR, threat intelligence, IAM, email security, networking, ticketing, and other security technologies
- Continuously evaluate detections and automated workflows to ensure they are actually improving security outcomes
Skills
- 4+ years of cybersecurity experience with meaningful exposure to Security Operations/SOC functions
- Strong understanding of common cyber threats, attack techniques, incident investigation, and SOC workflows
- Hands-on experience with SIEM and SOAR technologies
- Experience developing and tuning threat-detection rules and SOC use cases
- Strong knowledge of security logs and telemetry and the ability to explain which data sources are necessary to detect particular attacks
- Experience building or maintaining SOAR playbooks and automated response workflows
- Strong Python and/or security scripting skills
- Experience integrating security tools through APIs
- Knowledge of endpoint, identity, network, email, application, server, and cloud security
- Experience with incident response, threat hunting, malware analysis, and/or digital forensics
- Knowledge of MITRE ATT&CK and attacker tactics, techniques, and procedures
- Strong troubleshooting and analytical skills
- Excellent communication skills and the ability to work effectively with both SOC analysts and engineering teams
- Healthcare or other highly regulated enterprise experience is a plus
Benefits
- 100% Remote
- Full-Time, Direct Hire
- Comprehensive benefits
Company Overview