Senior SOC Detection Engineer

Job not on LinkedIn

🔥 18 hours ago

🇬🇪 Georgia – Remote

⏰ Full Time

🟠 Senior

👷🏻‍♀️ Engineer

👻 Ghost score 10%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

SOFTSWISS

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

💼 Consulting

📣 Marketing

🎮 Gaming

Consulting • Marketing • Gaming

SOFTSWISS is a leading provider of iGaming software solutions, offering a wide range of products including iGaming Platform, Sportsbook Platform, Game Aggregator, Jackpot Aggregator, and more. Established in 2009, SOFTSWISS has grown to employ over 1,700 people across 4 international offices in Poland, Georgia, Malta, and several remote locations. The company is known for its innovation in the iGaming industry, being the first Crypto iGaming provider in the world. SOFTSWISS not only promotes a dynamic and flexible work culture with comprehensive employee benefits but also commits to social responsibility by supporting various campaigns and initiatives.

📋 Description

• Own the full lifecycle of security detections, from researching attack techniques and defining logging requirements to developing, testing, deploying, and continuously improving detection content in Splunk • Develop, test, deploy, and maintain detection and correlation rules in Splunk or a similar SIEM • Translate incident investigations, threat hunting, and attack research into effective detections • Analyze false positives, false negatives, and detection gaps • Improve detection coverage and map detections to MITRE ATT&CK techniques • Develop and optimize SPL queries, dashboards, reports, and risk-based detections • Define requirements for logging, parsing, normalization, enrichment, and data quality • Develop monitoring and health checks for detection rules and data sources • Contribute to automated detection testing, synthetic events, telemetry replay, and CI/CD workflows • Participate in incident investigations, threat hunting, purple team exercises, and attack emulation • Collaborate with SOC, Incident Response, Threat Intelligence, Infrastructure, and Engineering teams • Document detection logic, data sources, dependencies, limitations, and expected behavior • Strengthen the company’s ability to identify, investigate, and respond to security threats across Windows, Linux, and Kubernetes environments

🎯 Requirements

• Strong hands-on experience in SOC, Detection Engineering, Threat Hunting, Incident Response, or a related field • Deep understanding of MITRE ATT&CK, common attack techniques, and detection methodologies • Strong proficiency in Splunk SPL or another enterprise SIEM platform • Experience developing complex queries, correlations, dashboards, and reports • Practical experience tuning detections and managing exceptions and allowlists • Ability to define and evaluate logging and telemetry requirements • Proficiency in Python, PowerShell, or Bash for automation • Experience with Git, code reviews, APIs, and basic CI/CD practices • Understanding of Windows and Linux security monitoring • Ability to independently investigate complex problems and drive solutions to completion • Strong communication skills and the ability to work effectively across teams • Experience with Splunk Enterprise Security, CIM, data models, macros, and lookups • Experience with Sysmon, Windows security auditing, Active Directory, auditd, osquery, Tetragon, Docker, or Kubernetes • Experience with YARA, CALDERA, Shuffle, or other security automation and attack emulation tools • Experience building detection quality metrics and automated validation frameworks • Experience with Terraform, Ansible, or other infrastructure-as-code tools • Participation in security research, conferences, or the broader security community

🏖️ Benefits

• Private health insurance • Sports benefits • Comprehensive Mental Health Program • Free English lessons (online) • Local language courses • Paid time off • Maternity leave support • Referral program rewards • Upskilling, internal workshops, and participation in professional conferences and corporate events