SOC L2/L3 Engineer – SIEM & Detection Engineering

About the role

Solidgate, a payments orchestration platform processing millions of payments across 120+ services in a regulated environment with real cardholder data and SWIFT connectivity, is looking for a SOC L2/L3 engineer to build and own its security operations. The role covers the full detection lifecycle, from log onboarding and rule design to triage, incident response and reporting.

Key responsibilities

• Build and operationalize the SIEM from proof of concept to production, including case management and UEBA, with full ownership of technology selection
• Write and tune MITRE ATT&CK-based detection rules for identity compromise, privilege escalation, lateral movement and endpoint threats
• Triage and investigate L2/L3 alerts, reduce false positives and set escalation paths
• Lead incident response and basic forensics, including containment, eradication and lessons learned
• Onboard log sources across AWS, JumpCloud, Google Workspace, CDE and SWIFT
• Run threat hunts based on realistic attack hypotheses for a payment platform
• Maintain runbooks and playbooks, automate actions with SOAR or scripting, and define SOC metrics and monthly reports

Required profile

• 3+ years in SOC / detection and response at L2/L3 level with hands-on investigation experience
• Practical experience building or running a SIEM and writing/tuning detection rules
• Threat detection with MITRE ATT&CK mapping
• Investigation of cloud log sources such as AWS CloudTrail, GuardDuty, Google Workspace and EDR/XDR
• Understanding of attacker techniques as they appear in logs
• Structured under pressure, with disciplined investigation and clear documentation

Required skills

• KQL, SPL or equivalent query languages
• Python or similar scripting for telemetry processing and automation
• Nice to have: SOAR and detection-as-code, UEBA, threat intelligence enrichment, CDE monitoring, PCI DSS context, purple teaming

What we offer

• Own the security operations direction and a greenfield SOC to build from scratch
• Path to leading the SOC function within 6-12 months, with a CISO who came up through the technical side
• 30+ days off, unlimited sick leave, free office meals, health coverage and Apple gear
• Courses, conferences, sports and wellness benefits