About the Role

You are a senior technical authority in our SOC — leading major incidents, running proactive threat hunts, building the detections and automation the whole team relies on, and mentoring analysts across every tier.

What You'll Do

• Lead response for complex, high-severity incidents from detection through eradication
• Run hypothesis-driven threat hunts and turn findings into new detections
• Build and maintain detection content, playbooks, and SOAR/automation logic
• Perform advanced analysis — malware triage, forensic artifacts, and adversary tradecraft
• Partner with detection engineering and purple-team efforts to close coverage gaps
• Mentor Tier 1 and Tier 2 analysts and set technical standards for the team

What You'll Bring

• 5+ years in SOC, incident response, or threat hunting roles
• Deep KQL and detection engineering expertise (Sentinel content development a plus)
• Strong DFIR skills and familiarity with malware analysis techniques
• Cloud security depth in Azure (AWS/GCP a plus)
• Advanced certification such as GCIH, GCFA, GREM, or OSCP
• Proven scripting/automation ability

Nice to Have

• Published research or conference talks
• Experience building SOAR automation at scale
• Reverse engineering / threat intelligence background