{"id":157673,"url":"https://alion.io/job/tekion-security-threat-detection-engineer-ii-soc","title":"Security Threat Detection Engineer - II (SOC)","company":{"id":804,"name":"Tekion","domain":"tekion.com","url":"https://alion.io/company/tekion","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":81,"open_postings":12,"ghost_share":0,"stale_share":0.75,"repost_share":0,"time_to_fill_p50_days":48,"computed_at":"2026-10-19T05:45:15Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":17000,"max_usd":40000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":714},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"ISO 27001","optional":false},{"name":"Machine Learning","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Threat Modeling","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"LLM","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-08-24T06:48:05Z","employer_posted_date":"2026-08-24","last_verified_at":"2026-10-20T04:01:19Z","board_verified":true,"closed_at":null,"days_open":56,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":56},"description":"About Tekion:\nPositively disrupting an industry that has not seen any innovation in over 50 years, Tekion has challenged the paradigm with the first and fastest cloud-native automotive platform that includes the revolutionary Automotive Retail Cloud (ARC) for retailers, Automotive Enterprise Cloud (AEC) for manufacturers and other large automotive enterprises and Automotive Partner Cloud (APC) for technology and industry partners. Tekion connects the entire spectrum of the automotive retail ecosystem through one seamless platform. The transformative platform uses cutting-edge technology, big data, machine learning, and AI to seamlessly bring together OEMs, retailers/dealers and consumers. With its highly configurable integration and greater customer engagement capabilities, Tekion is enabling the best automotive retail experiences ever. Tekion employs close to 3,000 people across North America, Asia and Europe.\nJob Introduction:\nThe Security Threat Detection Engineer II (SOC) is a hands-on member of the company's 24x7 Security Operations Center, responsible for monitoring, triaging, and responding to security alerts across the company's technology environment. This role operates on a rotating shift schedule, including night shifts, weekends, and holidays, to ensure continuous security coverage. A major focus of this role is responding to and investigating security alerts, reducing false positives through detection tuning, building and improving detection rules, conducting proactive threat hunting, performing malware analysis to support investigations, tracking and reporting SOC metrics, and automating response workflows using AI agents and SOAR platforms. The Engineer II works on moderately complex projects with minimal supervision and partners with IT, Engineering, and Security Operations to identify risks, remediate vulnerabilities, and strengthen overall security posture.\nKey Roles & Responsibilities\nWork in a 24x7 SOC environment on a rotating shift schedule, including night shifts, weekends, and holidays, providing continuous alert monitoring and response coverage.\n\nTriage, investigate, and respond to security alerts from SIEM, EDR, cloud, network, and identity sources; escalate confirmed incidents per established procedures.\n\nContinuously tune detections and alert logic to reduce false positives and improve signal-to-noise ratio across the alert pipeline.\n\nBuild, test, and maintain detection rules and use cases aligned to frameworks such as MITRE ATT&CK, based on emerging threats and gaps identified during investigations.\n\nConduct proactive, hypothesis-driven threat hunts across endpoint, network, cloud, and identity telemetry to uncover threats that evade existing detections, and convert hunt findings into new detection rules.\n\nPerform malware analysis (static and dynamic/sandbox-based) on suspicious files, scripts, and artifacts to determine behavior, extract indicators of compromise (IOCs), and inform containment, detection, and response actions.\n\nDesign, build, and maintain automation using AI agents and SOAR workflows/playbooks to accelerate alert triage, enrichment, containment, and response.\n\nDefine, track, and report SOC metrics (e.g., MTTD, MTTR, alert volume, false positive rates, automation coverage) to measure and improve SOC effectiveness.\n\nParticipate in incident detection, response, containment, and root cause analysis, including post-incident reviews and lessons learned.\n\nImplement, configure, and maintain security tools, monitoring systems, and access controls that support SOC operations.\n\nSupport vulnerability management, including scanning, analysis, and remediation coordination.\n\nCollaborate with Engineering and IT teams to embed security best practices and improve telemetry, logging, and detection coverage.\n\nAssist in maintaining compliance with security standards and regulatory requirements (e.g., SOC 2, ISO 27001, NIST).\n\nContribute to threat modeling and risk assessments for new projects and technologies.\n\nCreate and maintain security documentation, runbooks, playbooks, and knowledge bases to support consistent shift handoffs and response quality.\n\nProvide guidance and mentorship to junior engineers and analysts, including during shift operations.\n\nStay current on emerging security threats, detection techniques, AI-driven security tooling, and technologies.\n\nBasic Qualifications\nBachelor's degree in Computer Science, Cybersecurity, Engineering, or related field; equivalent experience considered.\n\n4-6 years of experience in security operations, security engineering, incident response, or related roles.\n\nWillingness and ability to work in a 24x7 SOC on a rotating shift schedule, including night shifts, weekends, and holidays.\n\nHands-on experience with alert triage, investigation, and incident response in a SOC environment.\n\nExperience building and tuning detections in SIEM/EDR platforms and reducing false positives; familiarity with MITRE ATT&CK.\n\nExperience conducting threat hunts using endpoint, network, cloud, and identity telemetry, and translating findings into detections.\n\nExperience with malware analysis, including static and dynamic analysis, sandboxing tools, and IOC extraction; familiarity with tools such as sandbox environments, YARA, or disassemblers/debuggers is a plus.\n\nExperience with SOAR platforms and building automated playbooks; exposure to AI agents or LLM-based automation for security operations strongly preferred.\n\nStrong understanding of network, application, and cloud security principles.\n\nExperience with security tools such as SIEM, EDR, IDS/IPS, vulnerability scanners, and endpoint protection.\n\nKnowledge of cloud platforms (AWS, GCP, Azure) and their security services and logging.\n\nFamiliarity with compliance and security frameworks (NIST, ISO 27001, SOC 2, CIS).\n\nScripting or automation experience (Python, Bash, or equivalent) preferred.\n\nExperience defining and reporting operational security metrics (MTTD, MTTR, false positive rates) preferred.\n\nStrong analytical and problem-solving skills.\n\nGood written and verbal communication abilities, including clear documentation and shift handoffs.\n\nIndustry certifications such as CISSP, GCIH, GCIA, GCFA, GREM, GCTI, or CEH preferred.\n\nPerks & Benefits\nOpportunity to work with some of the smartest minds to solve complex challenges at scale.\n\nImpactful role in shaping and securing a global, cloud-native & AI driven platform.\n\nInnovative, collaborative, and fast-paced culture.\n\nCurrent Tekion Employees: Please apply via the Internal Job Board in Ashby\nNote: Tekion recently transitioned to a new recruiting tool and we appreciate your patience and feedback as we adjust to our new system!\nTekion is proud to be an Equal Employment Opportunity employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, victim of violence or having a family member who is a victim of violence, the intersectionality of two or more protected categories, or other applicable legally protected characteristics.\nFor more information on our privacy practices, please refer to our Applicant Privacy Notice here.","description_format":"text","description_chars":7337,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Automotive Software"],"lifecycle":[{"event":"open","at":"2026-08-24T06:48:05Z"}],"visa":[],"liveness":{"score":27,"band":"fade","label":"Fading","p_open":1,"p_active":0.499,"p_room":0.55,"age_days":55,"expected_fill_days":48,"reasons":["conf:0","stale_co","velocity","win:tail"],"computed_at":"2026-10-19T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/tekion-security-threat-detection-engineer-ii-soc","json_url":"https://alion.io/job/tekion-security-threat-detection-engineer-ii-soc.json","meta":{"generated_at":"2026-10-20T04:28:11Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5014,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":804},"rest":"https://alion.io/mcp/rest/get_company?id=804"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftekion-security-threat-detection-engineer-ii-soc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftekion-security-threat-detection-engineer-ii-soc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftekion-security-threat-detection-engineer-ii-soc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tekion-security-threat-detection-engineer-ii-soc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftekion-security-threat-detection-engineer-ii-soc"}]}