SOC Developer
Ensign is hiring !
Key Responsibilities:
Develop, customize, and maintain security monitoring content for SIEM and SOAR platforms (e.g., custom rules, alerts, correlation searches, dashboards).
Build automation playbooks for incident response using SOAR platforms to reduce response time and analyst workload.
Integrate new data sources into SIEM tools and ensure parsing, normalization, and enrichment.
Create and maintain scripts and tools to support threat detection, investigation, and reporting.
Work with SOC Analysts and Threat Hunters to develop new detection use cases and improve existing ones.
Participate in the threat lifecycle, assisting in the development of detection logic based on threat intel and attack techniques (e.g., MITRE ATT&CK).
Collaborate with infrastructure and application teams to ensure proper logging and telemetry.
Maintain documentation of code, detection logic, use case coverage, and automation workflows.
Requirements:
Education & Certification:
Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field.
Certifications such as GIAC GMON, GCDA, GCIA, or equivalent are an advantage.
Technical Skills:
Strong experience with SIEM technologies (e.g., Splunk, QRadar, ELK).
Experience with SOAR platforms (e.g., Cortex XSOAR, Splunk Phantom, IBM Resilient).
Proficiency in scripting and development languages such as Python, JavaScript, or Bash.
Familiarity with REST APIs, JSON, and integration methods.
Understanding of cybersecurity concepts, attack techniques, and defensive strategies.
Familiarity with MITRE ATT&CK, cyber threat intelligence, and incident handling workflows.