Netradyne harnesses the power of Computer Vision and Edge Computing to revolutionize the modern-day transportation ecosystem. We are a leader in fleet safety solutions. With growth exceeding 4x year over year our solution is quickly being recognized as a significant disruptive technology. Our team is growing and we need forward-thinking uncompromising competitive team members to continue to facilitate our growth.
About Netradyne and the Global SOC
Netradyne builds AI-powered video telematics and fleet safety solutions led by its Driver-i platform used by commercial fleets worldwide. Our environment spans cloud-native SaaS edge IoT devices in vehicles large volumes of video and telemetry data and AI/ML platforms.
The Global SOC protects this footprint around the clock. It runs a multi-cloud SOC integrating SIEM SOAR threat intelligence endpoint identity email SaaS and cloud telemetry and is moving to an AI-driven operating model with agentic triage correlation and response under human approval controls. The SOC also supports ISO 27001 and ISO/IEC 42001 governance and the AI Security Posture Management (AISPM) program.
Role purpose
You will lead investigations that L1 cannot close drive incidents to containment and continuously raise the quality of our detections. You will be a hands-on technical leader on shift: mentoring L1 analysts tuning the AI-assisted triage pipeline and turning every incident into better playbooks detections and controls across AWS Azure SaaS endpoints and our IoT fleet platform.
Key responsibilities
Monitoring triage and investigation
- Act as the L2/L3 escalation point for alerts across SIEM EDR identity email SaaS and cloud security tools.
- Perform deep-dive investigations correlating logs endpoint telemetry network data cloud audit trails and threat intelligence.
- Validate enrich and prioritize alerts using a risk-based approach and reduce false positives at source.
- Review and quality-check L1 triage decisions and AI-generated triage recommendations before closure.
Incident response
- Lead security incidents through detection containment eradication recovery and post-incident review.
- Coordinate with Engineering SRE IT Legal and Privacy during incidents and communicate status clearly to SOC leadership.
- Perform host and cloud forensics triage malware analysis at a functional level and evidence preservation.
- Write incident reports and root-cause analyses with concrete tracked remediation actions.
Detection engineering and threat hunting
- Build test and tune detection rules and correlation logic mapped to MITRE ATT&CK.;
- Run hypothesis-driven threat hunts across cloud endpoint identity and SaaS telemetry.
- Track coverage gaps and propose new log sources detections and use cases.
- Operationalize threat intelligence (IOCs TTPs advisories) relevant to SaaS cloud and IoT environments.
Automation and AI-driven SOC
- Design and improve SOAR playbooks for enrichment triage and response.
- Help define and validate AI agent workflows confidence thresholds guardrails and human-approval gates for security operations.
- Monitor AI security signals from the AISPM program including shadow AI unauthorized agents unregistered MCP services and data-leakage alerts.
Process metrics and mentoring
- Maintain runbooks playbooks escalation matrices and SOPs.
- Track and improve SOC metrics such as MTTD MTTR SLA adherence and false-positive rate.
- Mentor and coach L1 analysts run shift handovers and knowledge-sharing sessions.
- Provide evidence and support for ISO 27001 ISO/IEC 42001 and customer security audits.
Required qualifications
- Bachelors degree in Computer Science IT Cybersecurity or equivalent practical experience.
- 58 years in information security with 3 years in a SOC at L2 or L3.
- Hands-on expertise with at least one enterprise SIEM (Splunk Wazuh QRadar or similar) including writing queries and detection rules.
- Strong experience with EDR/XDR platforms such as CrowdStrike Falcon or Microsoft Defender.
- Solid understanding of AWS and Azure security logging and services (CloudTrail GuardDuty Security Hub Entra ID Defender for Cloud).
- Working knowledge of identity attacks and controls: SSO federation MFA conditional access privileged access.
- Proven incident handling experience including ransomware phishing/BEC account compromise and cloud misconfiguration incidents.
- Good grasp of networking (TCP/IP DNS HTTP/S VPN firewalls proxies) and Windows Linux and macOS internals.
- Practical use of MITRE ATT&CK; the cyber kill chain and incident response frameworks such as NIST SP 800-61.
- Scripting ability in Python PowerShell or Bash for automation and log analysis.
- Transparent written and verbal communication including incident reports for technical and leadership audiences.
Preferred qualifications
- Certifications such as GCIH GCIA GCFA CySA BTL1/BTL2 CEH or AWS/Azure security certifications (AWS Security Specialty AZ-500 SC-200).
- Experience building SOAR playbooks and integrating security tools through APIs.
- Exposure to LLM-based or agentic security workflows AI security risks (prompt injection data leakage model abuse) and AI governance.
- Experience securing SaaS platforms containers and Kubernetes or IoT and edge devices.
- Digital forensics and malware analysis skills beyond triage level.
- Familiarity with ISO 27001 ISO/IEC 42001 SOC 2 or NIST CSF audit evidence.
- Experience in a product or SaaS company with a global 24x7 customer base.
Technology environment
- SIEM and log analytics - Wazuh Splunk ELK
- Endpoint and XDR - CrowdStrike Microsoft Defender
- Email security - Proofpoint
- Automation - SOAR Python REST APIs
- Threat intelligence - CTI feeds and platforms MITRE ATT&CK;
- Cloud - AWS Azure CSPM IAM WAF KMS
- Identity - SSO and federation across AWS Azure and SaaS
- AI and AI security - Azure OpenAI LangGraph AI registry AISPM MCP security
- Ownership under pressure: stays calm and decisive during live incidents.
- Communication: explains technical risk clearly to engineers and leadership alike.
- Collaboration: works across time zones with global Engineering IT and business teams.
- Continuous learning: keeps pace with new attack techniques cloud services and AI security risks.
- Mentoring mindset: raises the capability of the wider SOC team.
The role supports a 24x7 global SOC and involves rotational shifts and on-call escalation duty including occasional weekends during major incidents.
We are committed to an inclusive and diverse team. Netradyne is an equal-opportunity employer. We do not discriminate based on race color ethnicity ancestry national origin religion sex gender gender identity gender expression sexual orientation age disability veteran status genetic information marital status or any legally protected status.
If there is a match between your experiences/skills and the Companys needs we will contact you directly.
Netradyne is an equal-opportunity employer.
Applicants only - Recruiting agencies do not contact.
Recruitment Fraud Alert!
There has been an increase in fraud that targets job seekers. Scammers may present themselves to job seekers as Netradyne employees or recruiters. Please be aware that Netradyne does not request sensitive personal data from applicants via text/instant message or any unsecured method; does not promise any advance payment for work equipment set-up and does not use recruitment or job-sourcing agencies that charge candidates an advance fee of any kind. Official communication about your application will only come from emails ending in @ or @.
Please review and apply to our available job openings at For more information on avoiding and reporting scams please visit the Federal Trade Commissions job scams website.