{"id":4022917,"url":"https://alion.io/job/underdefense-middle-soc-security-engineer","title":"Middle SOC Security Engineer","company":{"id":2017495,"name":"UnderDefense","domain":"underdefense.com","url":"https://alion.io/company/underdefense","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Lviv, Ukraine"],"countries":["UA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Windows","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"Crowdstrike","optional":true},{"name":"ElasticSearch","optional":true},{"name":"GCP","optional":true},{"name":"Git","optional":true},{"name":"Kibana","optional":true},{"name":"Logstash","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"SentinelOne","optional":true}],"status":"live","first_seen_at":"2026-11-10T15:41:35Z","employer_posted_date":null,"last_verified_at":"2026-11-10T15:41:35Z","board_verified":false,"closed_at":null,"days_open":0,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":0},"description":"Position Summary\n\nWe have an exciting opportunity to join our team as a Middle SOC Security Engineer.\n\nUnderDefense is looking for a motivated and proactive engineer to join our MDR Engineering team. This role focuses on configuring, maintaining, and improving security monitoring infrastructure across multiple client environments.\n\nThe ideal candidate has hands-on experience with at least one SIEM platform, a solid understanding of security technologies, and a willingness to learn new tools and approaches.\n\nWe value engineers who take ownership of technical challenges, work independently, and collaborate with the team to deliver effective solutions for our clients.\n\nJob Responsibilities\n\nConfigure, maintain, and troubleshoot SIEM platforms, including Elastic Security, Splunk, Microsoft Sentinel, and other solutions depending on client environments.\n\nIntegrate log sources from Windows, Linux, network devices, cloud services, Microsoft 365, and EDR/XDR solutions.\n\nConfigure and maintain log collection through agents, connectors, APIs, and Syslog.\n\nTroubleshoot log ingestion, parsing, indexing, and integration issues.\n\nDevelop and maintain parsers for different log sources.\n\nCreate, test, and optimize detection and correlation rules to improve threat detection and reduce false positives.\n\nConfigure SIEM indexes, retention policies, and manage log ingestion volumes.\n\nMaintain integrations between SIEM/EDR/XDR solutions and the MAXI platform.\n\nSupport technical onboarding of new clients and ensure proper integration into SOC monitoring.\n\nMonitor the health and performance of existing security solutions.\n\nInvestigate technical issues, identify root causes, and implement effective solutions.\n\nCommunicate directly with clients' IT and security teams to understand technical requirements, discuss challenges, and provide solutions.\n\nPrepare technical documentation, configuration guides, and troubleshooting instructions.\n\nCollaborate with other engineers to improve existing processes, automate repetitive tasks, and support the scalability of MDR services.\nMinimum Qualifications\n\nHands-on experience with at least one SIEM platform, preferably Elastic Security, Splunk, Microsoft Sentinel, or a similar solution.\n\nPractical experience with log collection, processing, analysis, or security integrations.\n\nUnderstanding of Windows, Linux, networking fundamentals, and common network protocols.\n\nFamiliarity with Syslog, APIs, JSON, and log formats.\n\nExperience writing SIEM queries and working with detection or correlation rules.\n\nUnderstanding of EDR/XDR technologies and their role in security monitoring.\n\nStrong troubleshooting and analytical problem-solving skills.\n\nBasic scripting skills in Bash, Python, or PowerShell.\n\nAbility to independently investigate technical issues, take ownership of tasks, and deliver results.\n\nWillingness to learn new technologies and adapt to different security platforms and client environments.\n\nEnglish communication skills sufficient to discuss technical issues and solutions directly with clients.\nNice to Have\n\nPrevious experience in a SOC, MDR, or MSSP environment.\n\nHands-on experience with Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent).\n\nExperience with CrowdStrike, SentinelOne, or Microsoft Defender.\n\nFamiliarity with AWS, Azure, or GCP.\n\nExperience configuring SIEM environments or integrating log sources from scratch.\n\nExperience with Git and automating repetitive engineering tasks.\n\nExperience supporting multiple client environments.\nThe UnderDefense Mission Is Rooted in Values That Drive Us\n\nWe believe that success lies in execution, not credentials.\n\nWe act like owners, not just employees.\n\nWe work to find answers on our own, not wait for them to be given to us.\n\nWe optimize for mission, not ego.\n\nWe take responsibility for solving problems, even when they involve unfamiliar technologies.\n\nWe have growth mindsets, not fixed ones.","description_format":"text","description_chars":3936,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-11-10T15:41:35Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":30,"reasons":["seen:0","win:early"],"computed_at":"2026-11-10T17:28:31Z"},"pay":null,"html_url":"https://alion.io/job/underdefense-middle-soc-security-engineer","json_url":"https://alion.io/job/underdefense-middle-soc-security-engineer.json","meta":{"generated_at":"2026-11-10T17:28:31Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6191,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2017495},"rest":"https://alion.io/mcp/rest/get_company?id=2017495"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Funderdefense-middle-soc-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Funderdefense-middle-soc-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Funderdefense-middle-soc-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/underdefense-middle-soc-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Funderdefense-middle-soc-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4022917}},{"tool":"search_jobs","arguments":{"company":"underdefense.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4022917},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}