SOC Detection Engineer – Senior

SOC Detection Engineer – Senior

hot vacancy

September 16, 2026

Full time

WorldWide

Overview:

SOFTSWISS is hiring a Senior SOC Detection Engineer to join our Security Operations team. We are seeking a hands-on security professional to help build and develop our detection engineering function, strengthening the company’s ability to identify, investigate, and respond to security threats across Windows, Linux, and Kubernetes environments.

Purpose of the role:

You will be responsible for owning the full lifecycle of security detections, from researching attack techniques and defining logging requirements to developing, testing, deploying, and continuously improving detection content in Splunk. Your work will help enhance detection coverage, improve telemetry quality, reduce false positives, and ensure that security teams can reliably identify and respond to real threats.

Key responsibilities:

Develop, test, deploy, and maintain detection and correlation rules in Splunk or a similar SIEM.

Translate incident investigations, threat hunting, and attack research into effective detections.

Analyze false positives, false negatives, and detection gaps.

Improve detection coverage and map detections to MITRE ATT&CK techniques.

Develop and optimize SPL queries, dashboards, reports, and risk-based detections.

Define requirements for logging, parsing, normalization, enrichment, and data quality.

Develop monitoring and health checks for detection rules and data sources.

Contribute to automated detection testing, synthetic events, telemetry replay, and CI/CD workflows.

Participate in incident investigations, threat hunting, purple team exercises, and attack emulation.

Collaborate with SOC, Incident Response, Threat Intelligence, Infrastructure, and Engineering teams.

Document detection logic, data sources, dependencies, limitations, and expected behavior.

Required Experience:

Strong hands-on experience in SOC, Detection Engineering, Threat Hunting, Incident Response, or a related field.

Deep understanding of MITRE ATT&CK, common attack techniques, and detection methodologies.

Strong proficiency in Splunk SPL or another enterprise SIEM platform.

Experience developing complex queries, correlations, dashboards, and reports.

Practical experience tuning detections and managing exceptions and allowlists.

Ability to define and evaluate logging and telemetry requirements.

Proficiency in Python, PowerShell, or Bash for automation.

Experience with Git, code reviews, APIs, and basic CI/CD practices.

Understanding of Windows and Linux security monitoring.

Ability to independently investigate complex problems and drive solutions to completion.

Strong communication skills and the ability to work effectively across teams.

Nice to have:

Experience with Splunk Enterprise Security, CIM, data models, macros, and lookups.

Experience with Sysmon, Windows security auditing, Active Directory, auditd, osquery, Tetragon, Docker, or Kubernetes.

Experience with YARA, CALDERA, Shuffle, or other security automation and attack emulation tools.

Experience building detection quality metrics and automated validation frameworks.

Experience with Terraform, Ansible, or other infrastructure-as-code tools.

Participation in security research, conferences, or the broader security community.

Our technology focus:

Splunk Enterprise Security, MITRE ATT&CK, Windows and Linux telemetry, Kubernetes and container logs, Python, PowerShell, Bash, Git, and CI/CD.

Learn more about our hiring process here (link) – what to expect, how to prepare, and what makes SOFTSWISS different.

Main Advantages

Private health insurance

Sports benefits

Comprehensive Mental Health Program

Free English lessons (online)

Local language courses

Paid time off

Maternity leave support

Referral program rewards

Upskilling, internal workshops, and participation in professional conferences and corporate events

SOFTSWISS recruitment communication is conducted only through official company channels. We never ask candidates to make payments, purchase equipment, share financial details, or transfer money as part of the hiring process. If you receive a suspicious message using the SOFTSWISS name, please verify it via [email protected]

Apply for position

Your Email *

Your Name *

Your Last Name *

Resume/CV *

Requirements: PDF, DOC, up to 5Mb

Link to profile, such as LinkedIn

Copy & paste your cover letter, CV link or message

By filling out this form, you agree that your data will be processed by SOFTSWISS for recruitment purposes. You can withdraw your consent to the processing at any time. For more information, please read our Privacy Policy *

Apply now

Employer working-location policy Source: https://careers.softswiss.com/ SOFTSWISS’ employees are not limited to any specific workplace and are free to work from any location on the planet – in one of our five offices, or from home.

Work location The career page and current careers index list this role as worldwide. The employer states that employees can work from any location on the planet. The page also names Poland in its structured applicant-country metadata, which conflicts with its displayed worldwide location. The complete application has no country or work-authorisation question.

Application requirements Source: https://careers.softswiss.com/vacancies/soc-detection-engineer-senior/ The application requires an email address, given name, surname, a CV and privacy consent. Upload instructions say PDF/DOC up to 5 MB; the file picker also accepts DOCX. A profile link and message are optional. The visible form has no country, work-authorisation, sponsorship or office-choice question. The employer’s structured posting states 40 hours per week; exact daily hours and timezone are not stated. Base pay is not stated. Hiring process Source: https://careers.softswiss.com/blog/hiring-guide-softswiss/ The employer describes CV review, a recruiter call and core interviews. The number and structure vary by role. A test task may be required, sometimes before the main interview; test compensation is not stated. A further team meeting may occur.