SOC Detection Engineer Senior
SOFTSWISS is hiring a Senior SOC Detection Engineer to join its Security Operations team. The company is seeking a hands-on security professional to help build and develop its detection engineering function, strengthening the company’s ability to identify, investigate, and respond to security threats across Windows, Linux, and Kubernetes environments.
The purpose of the role is to own the full lifecycle of security detections, from researching attack techniques and defining logging requirements to developing, testing, deploying, and continuously improving detection content in Splunk. This work will help enhance detection coverage, improve telemetry quality, reduce false positives, and ensure that security teams can reliably identify and respond to real threats.
- Develop, test, deploy, and maintain detection and correlation rules in Splunk or a similar SIEM.
- Translate incident investigations, threat hunting, and attack research into effective detections.
- Analyze false positives, false negatives, and detection gaps.
- Improve detection coverage and map detections to MITRE ATT&CK techniques.
- Develop and optimize SPL queries, dashboards, reports, and risk-based detections.
- Define requirements for logging, parsing, normalization, enrichment, and data quality.
- Develop monitoring and health checks for detection rules and data sources.
- Contribute to automated detection testing, synthetic events, telemetry replay, and CI/CD workflows.
- Participate in incident investigations, threat hunting, purple team exercises, and attack emulation.
- Collaborate with SOC, Incident Response, Threat Intelligence, Infrastructure, and Engineering teams.
- Document detection logic, data sources, dependencies, limitations, and expected behaviour.
- Strong hands-on experience in SOC, Detection Engineering, Threat Hunting, Incident Response, or a related field (required).
- Deep understanding of MITRE ATT&CK, common attack techniques, and detection methodologies (required).
- Strong proficiency in Splunk SPL or another enterprise SIEM platform (required).
- Experience developing complex queries, correlations, dashboards, and reports (required).
- Practical experience tuning detections and managing exceptions and allowlists (required).
- Ability to define and evaluate logging and telemetry requirements (required).
- Proficiency in Python, PowerShell, or Bash for automation (required).
- Experience with Git, code reviews, APIs, and basic CI/CD practices (required).
- Understanding of Windows and Linux security monitoring (required).
- Ability to independently investigate complex problems and drive solutions to completion (required).
- Strong communication skills and the ability to work effectively across teams (required).
- Experience with Splunk Enterprise Security, CIM, data models, macros, and lookups (nice-to-have).
- Experience with Sysmon, Windows security auditing, Active Directory, auditd, osquery, Tetragon, Docker, or Kubernetes (nice-to-have).
- Experience with YARA, CALDERA, Shuffle, or other security automation and attack emulation tools (nice-to-have).
- Experience building detection quality metrics and automated validation frameworks (nice-to-have).
- Experience with Terraform, Ansible, or other infrastructure-as-code tools (nice-to-have).
- Participation in security research, conferences, or the broader security community (nice-to-have).
- Private health insurance
- Sports benefits
- Comprehensive Mental Health Program
- Free English lessons (online)
- Local language courses
- Paid time off
- Maternity leave support
- Referral program rewards
- Upskilling, internal workshops, and participation in professional conferences and corporate events
SOFTSWISS is a global tech expert with over 15 years of experience in providing innovative iGaming solutions. The company offers comprehensive software for online casinos, sports betting, and affiliate management. To expand its global presence, in 2024, SOFTSWISS acquired Turfsport, a leading South African betting software provider, and a significant stake in Ously Games GmbH, the company behind the fastest-growing European social casino, SpinArena.net. Additionally, the company appointed Formula 1 legend Rubens Barrichello as Non-Executive Director in Latin America, focusing on Brazil's growing market. SOFTSWISS is committed to transforming the iGaming and entertainment industry for the better through tech innovations. The Team helps operators and providers establish enduring partnerships by building profitable and scalable businesses.