Primary responsibilities include
Platform Management
Configure and maintain SIEM/SOAR platform
Monitor platform performance, availability, and data health
Review and maintain upgrades, integrations, and ongoing optimization
Manage role/scope-based access controls and data retention policies
Data Ingestion & Integration
Onboard and normalize log sources (firewalls, endpoints, servers, cloud, SaaS, identity providers, etc.)
Build integrations via scripting for custom data onboarding utilizing APIs
Troubleshoot ingestion issues and ensure log integrity and completeness
Review and maintain parsing rules and data mappings
Optimize data pipelines for performance and cost efficiency
SOC Operations Support
Develop, tune, and maintain detection rules logic, and alerting thresholds to improve fidelity and reduce false positives
Collaborate with SOC analysts during active investigations to provide platform support, log extraction, and forensic data retrieval
Vendor management and escalation support
Reporting & Dashboards
Build and maintain dashboards for SOC operations, compliance, and executive reporting
Develop and maintain scheduled and ad-hoc reports for stakeholders
Develop KPIs and metrics for security posture and incident trends
Continuous Improvement
Evaluate new log sources and security integrations
Recommend enhancements to improve visibility and coverage
Stay current on platform updates and best practices
Evaluate existing integrations and data to improve parsing, data normalization, and data reduction
The ideal candidate should possess the following
Bachelor’s degree in Cybersecurity, Information Technology, or related field (or equivalent experience)
3+ years of experience managing a SIEM platform
Knowledge of network protocols, firewalls, IDS/IPS, EDR, cloud security logs
Understanding of data normalization standards (CEF, LEEF, JSON, etc.)
Experience with SIEM query languages
Experience with scripting (Python, PowerShell, or similar) for automation
Working knowledge of MITRE ATT&CK, threat intelligence, and incident response processes
Preferred: 3+ years managing SOAR platform
Preferred: Experience developing automation, and response playbooks
Preferred: Familiarity with Azure, AWS, or GCP log configurations
Preferred: Experience supporting compliance frameworks (NIST, ISO 27001, SOX, HIPAA, etc.)
Preferred: Security+, CySA+, CASP+, GCIA, GCIH, CISSP or equivalent
Analytical and problem-solving skills
Strong troubleshooting and log analysis capabilities
Ability to translate security requirements into technical solutions
Strong communication skills for technical and executive audiences
Ability to work both independently and collaboratively in a fast-paced SOC environment
Travel up to 5 days per year
What We Offer You
We believe that by continuously improving the quality of our benefits, we can help to raise the quality of life for our team members and their families. At First Quality you will receive:
Competitive base salary and bonus opportunities
Paid time off (three-week minimum)
Medical, dental and vision starting day one
401(k) with employer match
Paid parental leave
Child and family care assistance (dependent care FSA with employer match up to $2500)
Bundle of joy benefit (years’ worth of free diapers to all team members with a new baby)
Tuition assistance
Wellness program with savings of up to $4,000 per year on insurance premiums
...and more!
First Quality is committed to protecting information under the care of First Quality Enterprises commensurate with leading industry standards and applicable regulations. As such, First Quality provides at least annual training regarding data privacy and security to employees who, as a result of their role specifications, may come in to contact with sensitive data.
First Quality is an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, sexual orientation, gender identification, or protected Veteran status.
