SOC L2/L3 Engineer
Solidgate · Remote · Europe · Warsaw · Nicosia · Kyiv · Lviv ·
COMPENSATION
€•• – ••k
Listed on the employer's job board (Ashby)
- Fully remote
- Build SOC from scratch
- SIEM & Detection Eng
- Path to SOC Lead
- Fintech / Payments
Join Solidgate as a key member of the InfoSec team, where you will define and build the Security Operations Center from scratch. You will own the technology selection, detection engineering, and incident response processes for a fintech platform processing millions of transactions.
This role offers the chance to shape the company's security posture in a regulated environment, with a clear path to leading the SOC function. You will work with real-world threats and complex data, avoiding legacy technical debt.
What you'll do
- Build and operationalize SIEM from proof of concept to production
- Design and tune detection rules mapped to MITRE ATT&CK framework
- Triage L2/L3 alerts and reduce false positives through investigation
- Lead incident response activities including containment and forensics
- Onboard log sources from AWS, Google Workspace, and SWIFT systems
- Conduct threat hunts based on realistic attack hypotheses
- Create runbooks and automate repetitive tasks via SOAR or scripting
- Define SOC metrics and report on detection coverage to management
What you'll need
- 3+ years in SOC or Detection & Response at L2/L3 level
- Hands-on experience building or operating a SIEM solution
- Proficiency in KQL, SPL, or equivalent query languages
- Experience investigating cloud logs like AWS CloudTrail and GuardDuty
- Scripting skills in Python or similar for automation tasks
- Deep understanding of attacker techniques and log manifestations
- Ability to maintain structured investigation processes under pressure
Nice to have
- Experience with SOAR and detection-as-code approaches
- Familiarity with UEBA and threat intelligence enrichment
- Knowledge of payment environments like CDE, SWIFT, and PCI DSS
- Purple teaming experience alongside offensive security teams
Stack
- SIEM
- AWS
- JumpCloud
- Google Workspace
- Python
- KQL
- SPL
- SOAR
What you get
- 30+ days of paid time off
- Unlimited sick leave policy
- Free office meals provided
- Comprehensive health coverage
- Apple hardware for productivity
- Budget for courses and conferences
- Sports and wellness benefits