Tech Stack

Description

You will partner directly with high-value customers to improve detection performance, combining SOC investigation with detection engineering. You'll own outcomes for 3-5 strategic accounts, work with AI-powered tools, and collaborate with GTM teams to drive measurable improvements.

Requirements

• 2-5 years of experience in SOC operations, detection engineering, incident response, email security analysis, or related cybersecurity role
• Experience with security monitoring and detection platforms such as SIEM, EDR, email security tools
• Experience in email attack analysis with ability to identify IOCs and TTPs
• Deep understanding of precision/recall metrics
• Proven experience triaging security alerts and performing root cause analysis
• Ability to perform standardized data analysis procedures
• Demonstrated proficiency with AI tools (ChatGPT, Claude, Claude Code, Copilot, or similar)
• Experience in technical writing for varying audiences
• Proven ability to work directly with customers or stakeholders on technical security issues
• Ability to remain calm during high-pressure situations
• Outcome-oriented mindset
• Strong ownership mentality

Responsibilities

• Own detection performance outcomes for 3-5 strategic customer accounts
• Handle high-priority false positive and false negative escalations
• Monitor and analyze misclassification patterns using internal tools
• Perform incident triage and alert correlation
• Design and implement detection tuning strategies
• Fine-tune detection thresholds and configurations
• Generate and present impact reports demonstrating measurable improvement
• Maintain close alignment with Sales and Customer Success
• Document detection issues, findings, and tuning approaches
• Review audit logs and analyze system interactions
• Identify cross-customer patterns and contribute to the operational playbook
• Submit D360 CFN reports and AISM submissions
• Provide feedback to the tooling team
• Support training of other team members
• Leverage AI tools in established workflows