We are looking for an experienced and driven SOC Content Engineer to join our growing SOC Services team. The candidate will be responsible for tuning correlation rules, reducing false positives, managing content lifecycle, and aligning detection use cases with evolving threat landscapes. The ideal candidate should have hands-on experience in SIEM rule engineering, detection tuning, analytics validation, and SOC operational alignment (preferably on the Securonix platform).
Key Responsibilities
1. Design and develop current detection use cases aligned with the MITRE ATT&CK; framework, threat intelligence inputs, Risk scenarios, and business impact
2. MITRE ATT&CK; coverage improvement.
3. Build use cases- Policy-based, correlation-based, behavior-based, risk-scoring-based.
4. Translate threat models/ scenarios into meaningful use cases.
5. Build detection logic based on- UEBA, Insider threat, Lateral movement, Data exfiltration.
6. Define policy baselines and deviation thresholds.
7. Continuously enhance detection models/ policies based on real SOC feedback.
8.
Provide policy recommendations to reduce alert fatigue/ reduce false positives.
9. Provide validation/ testing of policies with synthetic data and validate detection and alert quality.
10. Quarterly policy review and validations aligned to the MITRE framework.
11. Work with the onboarding team to ensure the missing logs are ingested to enhance the use case/ detection logics.
12. Support with compliance and audit-related activities.
13. Document and maintain all stages of the policy /content management cycle for compliance purposes.
Required technical skill sets
- Hands-on experience with at least one SIEM platform.
- Experience in Correlation rule creation, behavioral analytics tuning, Query languages (SPL, KQL, AQL, SQL-like queries), and understanding of log normalization and data taxonomy.
- Strong analytical mindset with threat modeling capability.
- Experience generating synthetic logs and test scenarios.
- Ability to analyze JSON/XML structured logs.
- Ability to convert business risks into technical detection logic.
Required Experience
- 5-6 years of hands-on experience in SIEM content creation and management.
- Strong threat analysis knowledge