{"id":1041584,"url":"https://alion.io/job/softswiss-soc-detection-engineer-senior","title":"SOC Detection Engineer – Senior","company":{"id":8389,"name":"SOFTSWISS","domain":"softswiss.com","url":"https://alion.io/company/softswiss","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Teamtailor","truth_index":{"grade":"B","score":83,"open_postings":3,"ghost_share":0,"stale_share":0.667,"repost_share":0,"time_to_fill_p50_days":38,"computed_at":"2026-11-15T07:52:55Z"}},"role":"Hardware","role_family":"Hardware","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Tbilisi, Georgia"],"countries":["GE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":46000,"max_usd":106000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":1936},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"CI/CD","optional":false},{"name":"Git","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Windows","optional":false},{"name":"Active Directory","optional":true},{"name":"Ansible","optional":true},{"name":"Cilium Tetragon","optional":true},{"name":"Docker","optional":true},{"name":"osquery","optional":true},{"name":"Shuffle","optional":true},{"name":"Sysmon","optional":true},{"name":"Terraform","optional":true},{"name":"YARA","optional":true},{"name":"YARA","optional":true}],"status":"live","first_seen_at":"2026-09-16T12:38:05Z","employer_posted_date":"2026-09-16","last_verified_at":"2026-11-15T17:06:20Z","board_verified":true,"closed_at":null,"days_open":60,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":60},"description":"Overview:\nSOFTSWISS is hiring a Senior SOC Detection Engineer to join our Security Operations team. We are seeking a hands-on security professional to help build and develop our detection engineering function, strengthening the company’s ability to identify, investigate, and respond to security threats across Windows, Linux, and Kubernetes environments.\nPurpose of the role:\nYou will be responsible for owning the full lifecycle of security detections, from researching attack techniques and defining logging requirements to developing, testing, deploying, and continuously improving detection content in Splunk. Your work will help enhance detection coverage, improve telemetry quality, reduce false positives, and ensure that security teams can reliably identify and respond to real threats.\nKey responsibilities:\nDevelop, test, deploy, and maintain detection and correlation rules in Splunk or a similar SIEM.\n\nTranslate incident investigations, threat hunting, and attack research into effective detections.\n\nAnalyze false positives, false negatives, and detection gaps.\n\nImprove detection coverage and map detections to MITRE ATT&CK techniques.\n\nDevelop and optimize SPL queries, dashboards, reports, and risk-based detections.\n\nDefine requirements for logging, parsing, normalization, enrichment, and data quality.\n\nDevelop monitoring and health checks for detection rules and data sources.\n\nContribute to automated detection testing, synthetic events, telemetry replay, and CI/CD workflows.\n\nParticipate in incident investigations, threat hunting, purple team exercises, and attack emulation.\n\nCollaborate with SOC, Incident Response, Threat Intelligence, Infrastructure, and Engineering teams.\n\nDocument detection logic, data sources, dependencies, limitations, and expected behavior.\n\nRequired Experience:\nStrong hands-on experience in SOC, Detection Engineering, Threat Hunting, Incident Response, or a related field.\n\nDeep understanding of MITRE ATT&CK, common attack techniques, and detection methodologies.\n\nStrong proficiency in Splunk SPL or another enterprise SIEM platform.\n\nExperience developing complex queries, correlations, dashboards, and reports.\n\nPractical experience tuning detections and managing exceptions and allowlists.\n\nAbility to define and evaluate logging and telemetry requirements.\n\nProficiency in Python, PowerShell, or Bash for automation.\n\nExperience with Git, code reviews, APIs, and basic CI/CD practices.\n\nUnderstanding of Windows and Linux security monitoring.\n\nAbility to independently investigate complex problems and drive solutions to completion.\n\nStrong communication skills and the ability to work effectively across teams.\n\nNice to have:\nExperience with Splunk Enterprise Security, CIM, data models, macros, and lookups.\n\nExperience with Sysmon, Windows security auditing, Active Directory, auditd, osquery, Tetragon, Docker, or Kubernetes.\n\nExperience with YARA, CALDERA, Shuffle, or other security automation and attack emulation tools.\n\nExperience building detection quality metrics and automated validation frameworks.\n\nExperience with Terraform, Ansible, or other infrastructure-as-code tools.\n\nParticipation in security research, conferences, or the broader security community.\n\nOur technology focus:\nSplunk Enterprise Security, MITRE ATT&CK, Windows and Linux telemetry, Kubernetes and container logs, Python, PowerShell, Bash, Git, and CI/CD.\nOur Benefits:\nPrivate health insurance\n\nSports benefits\n\nComprehensive Mental Health Program\n\nFree English lessons (online)\n\nLocal language courses\n\nPaid time off\n\nMaternity leave support\n\nReferral program rewards\n\nUpskilling, internal workshops, and participation in professional conferences and corporate events","description_format":"text","description_chars":3716,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Health insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Gaming","Sports Betting","iGaming & Gambling"],"lifecycle":[{"event":"open","at":"2026-09-18T19:30:07Z"}],"visa":[],"liveness":{"score":37,"band":"fade","label":"Fading","p_open":1,"p_active":0.831,"p_room":0.45,"age_days":59,"expected_fill_days":38,"reasons":["conf:3","velocity","win:tail"],"computed_at":"2026-11-15T07:52:55Z"},"pay":null,"html_url":"https://alion.io/job/softswiss-soc-detection-engineer-senior","json_url":"https://alion.io/job/softswiss-soc-detection-engineer-senior.json","meta":{"generated_at":"2026-11-15T20:22:08Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14699,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8389},"rest":"https://alion.io/mcp/rest/get_company?id=8389"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsoftswiss-soc-detection-engineer-senior"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsoftswiss-soc-detection-engineer-senior"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsoftswiss-soc-detection-engineer-senior"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/softswiss-soc-detection-engineer-senior\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsoftswiss-soc-detection-engineer-senior"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":1041584}},{"tool":"search_jobs","arguments":{"company":"softswiss.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":1041584},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}