{"id":3876741,"url":"https://alion.io/job/mars-soc-detection-engineer","title":"SOC Detection Engineer","company":{"id":94439,"name":"Mars","domain":"mars.com","url":"https://alion.io/company/mars","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":81,"open_postings":65,"ghost_share":0,"stale_share":0.969,"repost_share":0,"time_to_fill_p50_days":17,"computed_at":"2026-11-07T05:47:08Z"}},"role":"Hardware","role_family":"Hardware","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["São Paulo, Brazil"],"countries":["BR"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"Git","optional":true}],"status":"live","first_seen_at":"2026-11-06T16:36:24Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-07T03:24:59Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Job Description:\nSOC Detection Engineer | Guararema, Brazil\nSupport the Cybersecurity Operations SIEM Detection Engineering capability across teams and business segments. This role is a deep technical subject matter expert who creates, tests, deploys and continuously improves SIEM detections to increase the efficiency and accuracy of incident detection and response. The role tunes existing detections to reduce unnecessary alerts, identifies gaps in detection coverage, validates telemetry for detection use cases and automates detection and investigation steps.\nWhat will be your key responsibilities?\nCreate, deploy and maintain SIEM detection rules aligned with MITRE ATT&CK.\nValidate detections through testing and attack simulation before and after deployment.\nReview and tune existing detections using performance metrics to improve true positive rates, reduce false positives and retire noisy or low-value rules.\nIdentify gaps in detection coverage across business segments and prioritize new use cases based on threat relevance and risk.\nEnsure security telemetry is complete, accurate and suitable for detection use cases.\nAutomate detection, enrichment and investigation steps to reduce manual analyst effort and speed up response.\nWork with SOC operations, incident response, threat intelligence and SOAR teams to turn threat insights and incident lessons learned into actionable detections.\nSupport integrations between SIEM, case management and enrichment platforms, working with the SOAR team, so that alerts carry the right context for triage.\nMaintain clear documentation of detection logic, tuning decisions and coverage mapping, and share knowledge with SOC stakeholders.\nWhat are we looking for?\n3+ years of work experience in cybersecurity or related information technology areas\nPrevious hands-on SOC analyst experience, with a practical understanding of alert triage, investigation workflows and how detection quality affects operations\nIntermediate to advanced experience with SIEM platforms and security query languages\nExperience developing detection use cases, correlating data and mapping detections to attack lifecycle frameworks (e.g., MITRE ATT&CK)\nKnowledge of common security log sources (e.g., EDR, Windows events, identity, cloud and network telemetry)\nSolid data analytics skills, including analyzing large datasets to find patterns, anomalies and tuning opportunities\nScripting experience (e.g., Python, PowerShell, Bash) and a good grasp of programming logic\nUnderstanding of offensive security and attacker techniques\nStrong technical writing and communication skills\nNice to have:\nExperience with detection-as-code and version control (e.g., Git)\nRelevant cybersecurity certifications (e.g., SIEM, detection engineering or incident response)\nUnderstanding of SOAR and security automation concepts\nWhat can you expect from Mars?\nWork with diverse and talented Associates, all guided by the Five Principles.\nJoin a purpose driven company, where we’re striving to build the world we want tomorrow, today.\nA strong focus on learning and development support from day one, including access to our in-house Mars University.\nAn industry competitive salary and benefits package, including company bonus.\n#LI-Onsite\n#TBdigital","description_format":"text","description_chars":3258,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Brazil","iso":"BR","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Pet Food, Supplies & Care","Security Operations","Confectionery"],"lifecycle":[{"event":"open","at":"2026-11-06T16:36:24Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":0,"expected_fill_days":17,"reasons":["conf:2","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-07T05:47:08Z"},"pay":null,"html_url":"https://alion.io/job/mars-soc-detection-engineer","json_url":"https://alion.io/job/mars-soc-detection-engineer.json","meta":{"generated_at":"2026-11-07T13:23:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16103,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":94439},"rest":"https://alion.io/mcp/rest/get_company?id=94439"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmars-soc-detection-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmars-soc-detection-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmars-soc-detection-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mars-soc-detection-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmars-soc-detection-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3876741}},{"tool":"search_jobs","arguments":{"company":"mars.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3876741},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}