Triage, investigate, and respond to alerts across the SOC queue, hitting SLAs and following playbooks
Lead incident investigations, gather evidence, correlate events, and coordinate containment and recovery
Build and tune AI-assisted and agentic workflows across SIEM, SOAR, and EDR, including Claude via API
Engineer detection content: rules, queries, and alert tuning mapped to MITRE ATT&CK
Write and maintain SOAR playbooks and automation scripts that cut manual toil and accelerate response
Hunt for threats proactively, forming and testing hypotheses against current adversary TTPs
Maintain the SOC technology stack: integrations, health, and content engineering across all platforms
Keep SOX and SOC 2 Type 2 audit-ready evidence: logging coverage, incident records, and procedures
Partner with IT, Cloud, Risk, and Compliance to embed telemetry and surface findings clearly

Bachelor’s degree in computer science, Cybersecurity, or a related field (or equivalent practical experience).
4+ years of hands-on experience in security operations, incident response, or threat detection
Deep expertise with SIEM, SOAR, EDR/XDR, detection engineering, and incident response
Experience writing SOAR playbooks and detection rules or queries in a major SIEM platform
Experience operating in SOX and SOC 2 Type 2 environments, including control evidence and audit support
Hands-on experience applying AI/LLMs to security operations or detection and response
Strong communication skills with both technical peers and non-technical stakeholders.

For more information about our benefit offerings, please visit our careers page at https://www.echo.com/company/careers.

Security Engineer

Key skills