IT Security Engineer

Pike Corporation•Fort Mill, SC

About The Position

The SOC Engineer is the technical lead for the organization's SIEM platform and serves as the SOC's Tier 3 escalation resource. This role owns the design, tuning, and continuous advancement of detection content, drives SOAR playbook creation and adherence, and provides deep investigative expertise for the most complex security incidents. The ideal candidate combines strong hands-on SIEM engineering and query-language skills with the judgment and leadership to mentor Tier 1/2 analysts and shape the SOC's detection strategy.

Requirements

4+ years of experience in cybersecurity, including at least 2 years of hands-on experience with an enterprise SIEM platform and its query language(s).
Demonstrated experience leading or serving as a senior/Tier 3 resource within a SOC or incident response function.
Strong hands-on experience building and tuning SIEM analytics rules and detection content.
Experience designing and maintaining SOAR playbooks or equivalent security orchestration/automation tooling.
Solid incident response and forensics experience, including investigation, evidence handling, and documentation.
Proficiency with scripting/automation (PowerShell, Python, or similar).
Experience integrating security tooling (EDR, email security, identity, network) into a SIEM for detection and correlation.
At least one relevant security certification (e.g., GCIA, GCIH, CySA+, Security+, or vendor-specific SIEM certifications).
Strong understanding of the MITRE ATT&CK framework and common adversary tactics, techniques, and procedures.
Able to respond to security incidents after hours when necessary.

Nice To Haves

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent experience).
Experience with SIEM dashboard/reporting development and executive/board-level reporting on security metrics.
Experience with AI/LLM-assisted alert enrichment or triage pipelines.
Familiarity with common enterprise security stack components (EDR, secure web gateway/CASB, identity providers, email security) and how they integrate into detection workflows.
Familiarity with SOC 2, risk assessments, and other GRC functions.
Advanced certifications (e.g., GCFA, GCTI, OSCP, CISSP) are a plus.
Excellent problem-solving skills and the ability to lead through ambiguity under pressure.
Strong communication skills, with the ability to convey technical findings to both technical and non-technical stakeholders.

Responsibilities

Own and advance the organization's SIEM platform, including analytics/correlation rules, dashboards, data connectors, ingestion/cost management, and the overall detection roadmap.
Lead detection engineering efforts: design, build, tune, and validate analytics rules across identity, endpoint, cloud, and network telemetry.
Serve as the SOC's Tier 3 escalation point, performing deep technical investigation, root-cause analysis, and forensic collection on the most complex or high-severity incidents.
Design, build, and maintain SOAR playbooks and drive consistent analyst adherence to documented playbook procedures.
Build automation and enrichment pipelines (including AI-assisted triage where applicable) to reduce manual effort and improve mean time to detect/respond.
Mentor and provide technical guidance to Tier 1/2 SOC analysts, including reviewing investigations and coaching on playbook execution.
Evaluate, onboard, and tune new log sources, data connectors, and threat intelligence feeds to expand detection coverage.
Partner with IAM, endpoint, and network security teams to ensure detection coverage keeps pace with control and infrastructure changes.
Track and report on detection engineering and SOC performance metrics (e.g., MTTD, MTTR, playbook adherence, false-positive rates).
Maintain thorough documentation of detection logic, playbooks, and incident response procedures.
Participate in on-call rotation and respond to security incidents after hours when necessary.