{"id":21204,"url":"https://alion.io/job/solidgate-soc-l2l3-engineer","title":"SOC L2/L3 Engineer","company":{"id":6021,"name":"Solidgate","domain":"solidgate.com","url":"https://alion.io/company/solidgate","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":95,"open_postings":47,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":105,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Hardware","role_family":"Hardware","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_regions","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Warsaw, Poland","Nicosia, Cyprus","Kyiv, Ukraine","Lviv, Ukraine"],"countries":["PL","CY","UA"],"hiring_countries":["DE","FR","GB","AT","BE","BG","HR","CZ","DK","FI","HU","IE","IT","NL","NO","PL","RO","ES","SE","CH","EE","GR","IS","LV","LI","LT","LU","MT","PT","SK","SI","UA","CY"],"hiring_countries_total":33,"salary":null,"salary_estimate":{"min_usd":72000,"max_usd":211000,"period":"year","method":null,"sample_n":3689},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Google Workspace","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PCI DSS","optional":false},{"name":"PoC Library","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-06-02T19:43:15Z","employer_posted_date":"2026-06-02","last_verified_at":"2026-10-16T10:39:23Z","board_verified":true,"closed_at":null,"days_open":135,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":135},"description":"Our Mission and Vision\nAt Solidgate, our mission is clear: to empower outstanding entrepreneurs to build exceptional internet companies. We exist to fuel the builders - the ones shaping the digital economy - with the financial infrastructure they deserve. To achieve that, we’re on a bold path: to become the #1 payments orchestration platform in the world.\nWe believe the future of payments is shaped by people who think big, take ownership, and bring curiosity and drive to everything they do. That’s exactly the kind of teammates we want on board.\nWe’re building the #1 payment orchestrator in the world - and the names behind us prove it. Clients include Bolt, Ajax,Nova Post,MEGOGO. Trusted by giants like J.P. Morgan. Ranked #2 in the “Employer of the Year 2026” award by Forbes Ukraine.\nWhy This Role Is Critical\nSolidgate processes millions of payments across 120+ services, including its own acquiring module, and operates in a regulated environment with real cardholder data and SWIFT connectivity. You'll define what detection looks like at Solidgate: what gets monitored, what gets detected, and how the team responds when something goes wrong.\nWhat You Will Own\nBuild and operationalize the SIEM from PoC to production - including case management and UEBA, with full ownership of the technology selection\n\nDesign, write, and tune detection rules mapped to MITRE ATT&CK, covering identity compromise, privilege escalation, lateral movement, and endpoint threats\n\nTriage and investigate L2/L3 alerts, reduce false positives, and establish clear escalation paths for each use case\n\nLead incident response and basic forensics - containment, eradication, and structured lessons learned\n\nOnboard log sources across AWS, JumpCloud, Google Workspace, CDE, and SWIFT;\n\nRun threat hunts based on realistic attack hypotheses specific to a payment platform's risk profile\n\nBuild and maintain runbooks and playbooks; automate repetitive actions via SOAR or scripting\n\nDefine SOC metrics and own monthly reporting to management on detection coverage and response performance\n\nOur Ideal Candidate\n3+ years in SOC / Detection & Response at L2/L3 level, with hands-on investigation experience\n\nPractical experience building or operating a SIEM, including writing and tuning detection rules\n\nDetection engineering with MITRE ATT&CK mapping; confident with KQL, SPL, or equivalent query languages\n\nExperience investigating cloud log sources: AWS CloudTrail, GuardDuty, Google Workspace, EDR/XDR\n\nScripting and automation skills (Python or similar) for telemetry processing and routine tasks\n\nSolid understanding of attacker techniques and how they manifest in logs - not just tool knowledge, but threat understanding\n\nStructured under pressure: disciplined investigation process, clear documentation, clean post-mortems\n\nThe Points That Make You Stand Out\nSOAR experience and a detection-as-code approach (version control for rules, CI pipelines for detection)\n\nUEBA, threat intelligence enrichment, or alert contextualization at scale\n\nFamiliarity with payment-specific environments - CDE monitoring, SWIFT, PCI DSS context\n\nPurple teaming experience working alongside an offensive security team\n\nWhy This Role Is a Career Accelerator\nYou'll own the Security Operations direction at Solidgate - this isn't a slot in someone else's SOC, it's yours to build\n\nReal data, real threats - a fintech processing millions of transactions is a genuinely complex detection environment, not a sandbox\n\nYou'll choose the stack: SIEM, SOAR, detection framework - your decisions will shape how Solidgate detects threats for years\n\nDirect path to leading the SOC function and growing the team as the company scales\n\nHands-on experience at the intersection of cloud-native infrastructure, IR, and detection engineering in a regulated environment - a combination rare outside large enterprises\n\nWhy Join Solidgate\nImpactful work: you're monitoring and defending financial infrastructure that processes millions of real payments. What you detect and respond to directly affects the company's risk profile and the businesses relying on the platform.\n\nCreative freedom: the SOC is greenfield. No inherited SIEM, no legacy detection rules, no alert fatigue from someone else's misconfigured use cases. You build the detection stack from scratch and own every decision in it.\n\nCareer growth: a realistic path to leading the Security Operations function within 6-12 months, with direct collaboration with a CISO who came up through the technical side. Want to go deeper into cloud detection, threat intelligence, or automation? That door is open.\n\nOwnership culture: you own the detection lifecycle end to end - log onboarding, use case design, triage, response, and reporting. No hand-offs, no findings that disappear into a backlog.\n\nPeople worth working with: a senior InfoSec team that takes security seriously and treats detection gaps as engineering problems worth solving. Smart, experienced teammates who raise the bar and actually have each other's backs.\n\nThe Extras: 30+ days off, unlimited sick leave, free office meals, health coverage, and Apple gear to keep you productive. Courses, conferences, sports and wellness benefits - all designed for ideas, focus, and fun.\nSecurity at scale is rare to build from scratch. This is that chance\nKnow top talent? We’re always on the lookout. Recommend someone for our role, and if they get hired, there’s a bonus waiting for you - simple as that.","description_format":"text","description_chars":5472,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Office meals"],"hiring_locations":[{"name":"Germany","iso":"DE","kind":"region"},{"name":"France","iso":"FR","kind":"region"},{"name":"United Kingdom","iso":"GB","kind":"region"},{"name":"Austria","iso":"AT","kind":"region"},{"name":"Belgium","iso":"BE","kind":"region"},{"name":"Bulgaria","iso":"BG","kind":"region"},{"name":"Croatia","iso":"HR","kind":"region"},{"name":"Czech Republic","iso":"CZ","kind":"region"},{"name":"Denmark","iso":"DK","kind":"region"},{"name":"Finland","iso":"FI","kind":"region"},{"name":"Hungary","iso":"HU","kind":"region"},{"name":"Ireland","iso":"IE","kind":"region"},{"name":"Italy","iso":"IT","kind":"region"},{"name":"Netherlands","iso":"NL","kind":"region"},{"name":"Norway","iso":"NO","kind":"region"},{"name":"Poland","iso":"PL","kind":"country"},{"name":"Romania","iso":"RO","kind":"region"},{"name":"Spain","iso":"ES","kind":"region"},{"name":"Sweden","iso":"SE","kind":"region"},{"name":"Switzerland","iso":"CH","kind":"region"},{"name":"Estonia","iso":"EE","kind":"region"},{"name":"Greece","iso":"GR","kind":"region"},{"name":"Iceland","iso":"IS","kind":"region"},{"name":"Latvia","iso":"LV","kind":"region"},{"name":"Liechtenstein","iso":"LI","kind":"region"},{"name":"Lithuania","iso":"LT","kind":"region"},{"name":"Luxembourg","iso":"LU","kind":"region"},{"name":"Malta","iso":"MT","kind":"region"},{"name":"Portugal","iso":"PT","kind":"region"},{"name":"Slovakia","iso":"SK","kind":"region"},{"name":"Slovenia","iso":"SI","kind":"region"},{"name":"Ukraine","iso":"UA","kind":"country"},{"name":"Warsaw","iso":null,"kind":"city"},{"name":"Nicosia","iso":null,"kind":"city"},{"name":"Kyiv","iso":null,"kind":"city"},{"name":"Lviv","iso":null,"kind":"city"},{"name":"Cyprus","iso":"CY","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Fraud Detection","Payment Processing & Gateways"],"lifecycle":[{"event":"open","at":"2026-06-02T19:43:15Z"}],"visa":[],"liveness":{"score":25,"band":"fade","label":"Fading","p_open":1,"p_active":0.561,"p_room":0.44,"age_days":135,"expected_fill_days":105,"reasons":["conf:0","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/solidgate-soc-l2l3-engineer","json_url":"https://alion.io/job/solidgate-soc-l2l3-engineer.json","meta":{"generated_at":"2026-10-16T12:06:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11217,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6021},"rest":"https://alion.io/mcp/rest/get_company?id=6021"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsolidgate-soc-l2l3-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsolidgate-soc-l2l3-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsolidgate-soc-l2l3-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/solidgate-soc-l2l3-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsolidgate-soc-l2l3-engineer"}]}