Senior Security Operations Engineer

Ready to strengthen detection, take ownership of security operations, and lead incident response when it matters?

Unplug Studio is recruiting a Senior Security Operations Engineer for a hands-on role supporting a global technology environment. You will help reduce daily triage load, improve detection coverage, strengthen incident response, and maintain operational continuity.

This opportunity combines deep technical work with clear communication across engineering teams, business stakeholders, security vendors, and executive leadership. You will work in a Zero Trust-oriented environment and contribute to the evaluation of evolving security platforms.

What You Will Do

Security operations and incident response

• Independently monitor alerts, investigate activity, and triage incidents across SIEM, WAF/ZTNA, cloud security, identity, MFA, and endpoint-management platforms.
• Execute defined containment playbooks for low- and medium-risk incidents and follow escalation boundaries for high-impact events.
• Participate in a 24/7 on-call rotation as a primary responder within a tiered escalation model.
• Take ownership of operational workloads and help stabilize security operations center (SOC) capacity.
  
  

Detection engineering and security tooling

• Build, optimize, and tune SIEM queries and detection rules for log analysis and false-positive reduction.
• Identify visibility gaps across cloud and SaaS environments and develop custom detection logic.
• Support security automation, alert enrichment, playbook improvements, and more efficient response.
• Contribute to discovery and proof-of-concept testing for SIEM, SOAR, managed SOC, and AI-enabled security platforms.
  
  

Collaboration and leadership readiness

• Connect Security Operations with Engineering, Corporate IT, DevOps, Legal, Privacy, and executive stakeholders.
• Work with security vendors and managed service providers to review service quality and agreed service-level commitments.
• Cross-train in threat intelligence and offensive-security methods to keep detection aligned with attacker behavior.
• Be ready to assume incident leadership and selected SOC management responsibilities during manager absence or critical escalation.
• Guide less-experienced analysts and strengthen escalation decisions, documentation, and playbooks.
  
  

What You Will Bring

• A bachelor’s degree or equivalent higher-education qualification from a program requiring at least three years of study.
• Proven hands-on experience in alert triage, threat hunting, incident investigation, and log correlation across cloud and enterprise environments.
• Advanced SIEM query construction and detection-tuning skills. Relevant experience includes LINQ, SPL, KQL, XQL, QRadar, ELK, or comparable query and detection frameworks.
• Practical experience with cloud-native security controls, identity and MFA platforms, WAF/ZTNA technologies, and endpoint-management tools.
• Experience in on-call rotations and the full incident lifecycle: investigation, containment, escalation, remediation, and post-incident follow-up.
• Experience developing, tuning, and validating detections while reducing false positives without weakening coverage.
• The ability to explain technical risk to executives, collaborate across functions, and work professionally with vendors during high-pressure situations.
• Strong written communication and incident-documentation skills.
• Working knowledge of GDPR and familiarity with international data-protection expectations, including U.S. and Canadian privacy requirements.
  
  

Preferred Qualifications

• Experience evaluating, implementing, or managing SIEM, SOAR, AI-enabled security platforms, or managed SOC transitions.
• Experience or a strong interest in threat intelligence, adversary tracking, purple teaming, or offensive-security methodology.
• Relevant certifications such as CISSP, GCIH, GCIA, AWS Certified Security – Specialty, CompTIA CySA+, or comparable credentials.
• Experience mentoring analysts or coordinating response during complex incidents.
  
  

Operational expectations

This role includes participation in a 24/7 on-call rotation. You will operate within defined escalation boundaries and may take on incident leadership when required.

How To Express Interest

Send your CV to [email protected] with the subject line “Senior Security Operations Engineer.” Include a short introduction highlighting your security operations, detection engineering, and incident response experience.

Explore Unplug Studio careers at Unplug Studio Careers.

About The Recruitment Process

The client’s identity and organization-specific details are withheld at this stage. Further environment information may be shared later in the recruitment process, where appropriate.