Lead Engineer, Security Operations Platform

Job summary

This role involves owning the engineering, evolution, and reliability of a core detection and response platform, including XDR, SIEM, and NDR systems. The position emphasizes a shift towards application monitoring and requires collaboration with various internal teams to enhance security monitoring capabilities.

Qualifications

• Minimum of 5 years of experience in security engineering or SecOps platform engineering, suitable for a senior individual contributor.
• Hands-on experience in a SOC or incident response environment.
• Proven expertise in engineering and operating SIEM platforms, including data connectors and analytics rules.
• Experience with infrastructure-as-code tools like Terraform or Bicep/ARM.
• Familiarity with Git, DevOps practices, and CI/CD pipelines in security tooling.
• Proficient in Python for integrations and automation.
• Understanding of cloud and identity ecosystems, particularly Azure and Active Directory.

Responsibilities

• Continuously improve the SecOps technology platform using platform-as-code and infrastructure-as-code methodologies.
• Design and implement scalable telemetry ingestion for PaaS and SaaS services.
• Maintain workflow integrations across the SecOps ecosystem, ensuring performance and security.
• Collaborate with application and product teams to embed security monitoring into new services.
• Work with Detection Engineers and SOC Analysts to align platform capabilities with operational needs.
• Monitor platform reliability and performance, conducting root-cause analysis as needed.

Skills

• Strong collaboration and communication skills to work with diverse teams and translate security requirements into actionable engineering tasks.

Education

• Relevant degree or equivalent experience in a related field is preferred.

Tools

• Experience with SIEM, NDR, EDR, SOAR, IAM, and ITSM tools.