Senior Security Engineer, Detection & Response (SOC)

PrizePicks•Atlanta, GA

5d•Remote

About The Position

PrizePicks is seeking a seasoned SOC engineer to help mature its Information Security detection, incident response, and forensics capabilities. This hands-on role spans monitoring, triage, response, and forensics, with ownership over how the program evolves. The role helps lead the existing team and build a SOC/IR function from an early stage toward production readiness. The engineer owns SIEM monitoring and alert triage, improves detection content, playbooks, threat hunting, digital forensics, and response automation, and leads incident response as needed. They also document incidents and remediation, establish blameless post-incident reviews and root-cause analysis, and shape the program’s metrics, escalation paths, and priorities. The role may be remote for qualified U.S. applicants, though Atlanta-based candidates are preferred.

Requirements

At least 5 years of experience in a SOC, incident response, or detection engineering role.
Demonstrated ownership of an incident response or monitoring program beyond queue work.
Experience building or significantly maturing a SOC/IR function from an early-stage program to production-ready.
Strong understanding of the incident response lifecycle: preparation, detection, containment, eradication, recovery, and lessons learned.
Hands-on SIEM experience with log ingestion, correlation rules, detection tuning, and content development; platform-agnostic experience is acceptable.
Digital forensics fundamentals, including host, network, and/or cloud evidence collection and analysis.
Ability to build scripting or automation for triage and response workflows using Python or a similar language.
Working knowledge of at least one major cloud provider: AWS, GCP, or Azure.
Familiarity with MITRE ATT&CK and common threat actor tactics, techniques, and procedures.
Ability to define risk in both technical and business-relevant terms.
Clear written communication skills for producing playbooks and incident documentation.
Must be authorized to work for any employer in the United States; employment visa sponsorship is not available.

Nice To Haves

Relevant certifications such as GCIH, GCFA, GCIA, OSCP, or equivalent.
Experience with a SOAR platform.
Prior experience in fintech, gaming, or another high-fraud-risk industry.
Experience running detection and incident response for a distributed or remote workforce, relying on endpoint and identity signals rather than a centralized network perimeter.

Responsibilities

Own SIEM event and alert monitoring and triage; tune detection content, reduce false positives, and close coverage gaps.
Design and continuously improve incident response playbooks.
Lead proactive threat hunting for malicious or anomalous activity not caught by existing alerting and automated detection.
Strengthen digital forensics capabilities, processes, tooling, investigations, and evidence handling.
Drive automation for alerting, enrichment, and triage workflows to reduce manual work and response time.
Respond to and lead incident response, coordinating with business partners as needed.
Document incidents, root causes, and remediation clearly and rigorously.
Build a structured, blameless post-incident review process with root-cause analysis, tracked action items, and follow-through.
Develop how the program measures and scales, including IR metrics, escalation paths, and priorities.

Benefits

Company-subsidized medical, dental, and vision plans.
401(k) plan with company match.
Annual bonus.
Flexible PTO; two weeks is strongly encouraged.
Generous paid leave programs, including 16-week paid parental leave and disability benefits.
Workplace flexibility and modern work schedules focused on getting the job done rather than hours clocked.
Company-wide in-person events and team outings.
Lifestyle enhancement program.
Company equipment provided, with Windows and Mac options.
Annual performance reviews with opportunities for growth and career development.