Middle SOC Security Engineer
Position Summary
We have an exciting opportunity to join our team as a Middle SOC Security Engineer.
UnderDefense is looking for a motivated and proactive engineer to join our MDR Engineering team. This role focuses on configuring, maintaining, and improving security monitoring infrastructure across multiple client environments.
The ideal candidate has hands-on experience with at least one SIEM platform, a solid understanding of security technologies, and a willingness to learn new tools and approaches.
We value engineers who take ownership of technical challenges, work independently, and collaborate with the team to deliver effective solutions for our clients.
Job Responsibilities
- Configure, maintain, and troubleshoot SIEM platforms, including Elastic Security, Splunk, Microsoft Sentinel, and other solutions depending on client environments.
- Integrate log sources from Windows, Linux, network devices, cloud services, Microsoft 365, and EDR/XDR solutions.
- Configure and maintain log collection through agents, connectors, APIs, and Syslog.
- Troubleshoot log ingestion, parsing, indexing, and integration issues.
- Develop and maintain parsers for different log sources.
- Create, test, and optimize detection and correlation rules to improve threat detection and reduce false positives.
- Configure SIEM indexes, retention policies, and manage log ingestion volumes.
- Maintain integrations between SIEM/EDR/XDR solutions and the MAXI platform.
- Support technical onboarding of new clients and ensure proper integration into SOC monitoring.
- Monitor the health and performance of existing security solutions.
- Investigate technical issues, identify root causes, and implement effective solutions.
- Communicate directly with clients' IT and security teams to understand technical requirements, discuss challenges, and provide solutions.
- Prepare technical documentation, configuration guides, and troubleshooting instructions.
Collaborate with other engineers to improve existing processes, automate repetitive tasks, and support the scalability of MDR services.
Minimum Qualifications
- Hands-on experience with at least one SIEM platform, preferably Elastic Security, Splunk, Microsoft Sentinel, or a similar solution.
- Practical experience with log collection, processing, analysis, or security integrations.
- Understanding of Windows, Linux, networking fundamentals, and common network protocols.
- Familiarity with Syslog, APIs, JSON, and log formats.
- Experience writing SIEM queries and working with detection or correlation rules.
- Understanding of EDR/XDR technologies and their role in security monitoring.
- Strong troubleshooting and analytical problem-solving skills.
- Basic scripting skills in Bash, Python, or PowerShell.
- Ability to independently investigate technical issues, take ownership of tasks, and deliver results.
- Willingness to learn new technologies and adapt to different security platforms and client environments.
English communication skills sufficient to discuss technical issues and solutions directly with clients.
Nice to Have
- Previous experience in a SOC, MDR, or MSSP environment.
- Hands-on experience with Elastic Stack (Elasticsearch, Logstash, Kibana, Elastic Agent).
- Experience with CrowdStrike, SentinelOne, or Microsoft Defender.
- Familiarity with AWS, Azure, or GCP.
- Experience configuring SIEM environments or integrating log sources from scratch.
- Experience with Git and automating repetitive engineering tasks.
Experience supporting multiple client environments.
The UnderDefense Mission Is Rooted in Values That Drive Us
- We believe that success lies in execution, not credentials.
- We act like owners, not just employees.
- We work to find answers on our own, not wait for them to be given to us.
- We optimize for mission, not ego.
- We take responsibility for solving problems, even when they involve unfamiliar technologies.
- We have growth mindsets, not fixed ones.