Specialist - SOC Engineering + SOAR

Profile Summary:

●As a Specialist- SOC Engineering, as part of the Cyber Defense Operations Center (CDOC) you will lead advanced security operations with a focus on SIEM and SOAR technologies, driving detection engineering, automated response, and complex incident handling. You’ll be responsible for optimizing detection rules, developing playbooks, and managing high-severity incidents from triage to resolution. In parallel, you’ll mentor Level 1 and 2 analysts, preparing to lead your own team in the future. While EDR remains part of the security stack, your primary emphasis is on engineering activities around SIEM and SOAR to enhance operational efficiency and threat mitigation. This role requires deep technical expertise, leadership potential, and a proactive approach to evolving threats.

Job Description:

●Manage and maintain NG SIEM solutions like Google Chronicle, Crowdstrike and support in leveraging SOAR capabilities by designing and implementing SOAR playbooks, including necessary integration and automation.

●Support on boarding and maintenance of a wide variety of data sources to include various OS, appliance, and application logs. Create Custom queries, custom dashboards, and visualizations.

●Develop and fine tune content for the different tools including but not limited to SIEM Use Cases, SOAR playbooks, Threat intelligence watchlist and rules.

●Select and recommend additional security solutions or enhance existing security solutions to improve overall METRO detection and response capabilities as per the METRO cyber security strategy.

●Develop appropriate use cases/playbooks/models/reports and alerts & develop custom parsers/connectors for integrating logs, wherever necessary or required.

●Perform analysis on the reported incidents, determine the root cause and recommend the appropriate solution.

●Use and apply learnings from incident and provide recommendation for standardizing the NG SIEM Solution.

●Reduction of False Positives by fine tuning existing correlation rules/configuration/playbooks/models

●Automation with continuous improvements, Reduction in MTTR, MTTD and Improvement of overall posture of NG SIEM deployment to achieve best ROI.

●Ensure the confidentiality, integrity and availability of the data residing on or transmitted to/from/through SOC controls.

●Generate reports and documentation related to platform performance and continuous improvement recommendations for management and stakeholders.

●Ensure the SIEM integration is intact among the SOC solutions and with other assets

●Design, create and customize the dashboards/reports as per the business needs.

●Create and manage NG SIEM knowledge objects to include apps, dashboards, saved and scheduled searches and alerts.