SOC Developer

Ensign is hiring !

Key Responsibilities

• Develop, customize, and maintain security monitoring content for SIEM and SOAR platforms (e.g., custom rules, alerts, correlation searches, dashboards).
• Build automation playbooks for incident response using SOAR platforms to reduce response time and analyst workload.
• Integrate new data sources into SIEM tools and ensure parsing, normalization, and enrichment.
• Create and maintain scripts and tools to support threat detection, investigation, and reporting.
• Work with SOC Analysts and Threat Hunters to develop new detection use cases and improve existing ones.
• Participate in the threat lifecycle, assisting in the development of detection logic based on threat intel and attack techniques (e.g., MITRE ATT&CK).
• Collaborate with infrastructure and application teams to ensure proper logging and telemetry.
• Maintain documentation of code, detection logic, use case coverage, and automation workflows.

Requirements

Education & Certification

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field.
• Certifications such as GIAC GMON, GCDA, GCIA, or equivalent are an advantage.

Technical Skills

• Strong experience with SIEM technologies (e.g., Splunk, QRadar, ELK).
• Experience with SOAR platforms (e.g., Cortex XSOAR, Splunk Phantom, IBM Resilient).
• Proficiency in scripting and development languages such as Python, JavaScript, or Bash.
• Familiarity with REST APIs, JSON, and integration methods.
• Understanding of cybersecurity concepts, attack techniques, and defensive strategies.
• Familiarity with MITRE ATT&CK, cyber threat intelligence, and incident handling workflows.