Security Engineer (SOC)

Job description

**This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer (SOC) based in United States.** Join a cybersecurity consulting environment focused on protecting IT, OT, cloud, and AI systems against evolving digital threats. As a Security Engineer specializing in Security Operations Center (SOC) technologies, you will lead detection engineering initiatives, strengthen security monitoring, and automate investigation and response workflows. You will work with SIEM, SOAR, EDR, and XDR platforms to improve detection accuracy and operational efficiency. AI-powered tools will support routine analysis and documentation, allowing you to focus on technical validation, strategic improvements, and tailored security solutions. Data confidentiality and responsible AI adoption remain central to every project. This fully remote opportunity combines complex cybersecurity challenges, technical innovation, and the potential for substantial performance-based earnings. ### Accountabilities: You will develop and optimize SOC capabilities, improve threat detection, and help security teams respond to incidents more effectively. Your responsibilities will include: - Build, operate, and continuously improve SOC platforms, including SIEM, SOAR, EDR, and XDR solutions. - Integrate new log sources by managing parsing, normalization, and data quality. - Develop and optimize detection rules and use cases using Sigma, KQL, and SPL, aligned with the MITRE ATT&CK framework. - Automate security analysis and incident response through playbooks and scripting with Python and PowerShell. - Establish Detection-as-Code pipelines with version control, testing, and CI/CD integration. - Integrate threat intelligence into security monitoring and operational workflows. - Collaborate with security analysts and incident responders to reduce false positives and improve detection quality. - Provide technical support during security incidents and contribute to effective response activities. - Create and maintain runbooks, use-case documentation, and technical concepts. - Use AI-assisted tools to analyze logs, draft detection rules and playbooks, and produce documentation, ensuring all outputs are critically reviewed and validated before use. - Apply strict data protection practices when using AI tools, preventing unauthorized disclosure and ensuring sensitive customer information is handled appropriately. **Requirements:** You bring substantial cybersecurity experience, strong technical expertise, and a responsible approach to AI-assisted security work. You should be comfortable working independently in a consulting environment while collaborating with technical teams and stakeholders. The key requirements include: - At least five years of experience in IT or cybersecurity, including several years in architecture or consulting roles. - Broad technical knowledge across networks, endpoints, identity, applications, and cloud environments. - Experience with Zero Trust architectures, network segmentation, and IAM/PAM technologies, including Microsoft Entra ID and Active Directory. - Strong understanding of security frameworks and methodologies, including ISO 27001, BSI IT-Grundschutz, NIST CSF, MITRE ATT&CK, and SABSA or TOGAF. - Knowledge of cryptography, public key infrastructure (PKI), and secure application design. - Confident use of AI tools in consulting workflows, including the ability to critically assess their outputs. - Strong awareness of AI-related confidentiality and security risks, including data leakage, model training, and prompt injection. - Willingness to continuously improve processes and products through responsible AI adoption. - Professional fluency in both German and English. **Additional qualifications that would be an advantage:** - Cloud architecture expertise covering the design, security, and operation of cloud and hybrid environments across Azure, AWS, or GCP. - Familiarity with cloud-native security services and Infrastructure as Code. - Experience with prompt engineering, AI agents, or integrating large language models (LLMs) into workflows. - Knowledge of AI governance frameworks and regulations, including the EU AI Act, ISO/IEC 42001, and the OWASP Top 10 for LLM Applications. - Experience working in regulated environments, such as critical infrastructure (KRITIS), financial services, or industrial and OT settings. - Relevant security certifications, such as OSDA, OSCP, SANS/GIAC certifications (including GCDA, GDSA, and GCIH), SANS SEC586, or Microsoft SC-200. **Benefits:** - **Competitive compensation:** Fixed annual salary starting at €80,000, plus profit sharing of up to €70,000. - **Fully remote work:** Location-independent work on cybersecurity and AI security projects. - **Flexible working hours:** Greater flexibility in organizing your working day. - **Generous leave:** 30 days of annual vacation. - **Technology equipment:** Apple MacBook and other necessary IT equipment. - **Retirement and health benefits:** Occupational pension provision and health insurance. - **Employee discounts:** Access to shopping offers and employee discounts. - **Team events:** Regular opportunities to connect and collaborate with colleagues. - **Permanent employment:** An open-ended employment contract. - **Professional development:** Opportunities to deepen your expertise in SOC platforms, detection engineering, automation, cloud security, and responsible AI adoption. - **Meaningful technical work:** Contribute to security projects that help protect critical digital environments and strengthen modern security operations.