SOC Engineer

We are seeking an experienced L2 SOC Engineer to strengthen our Security Operations Center. This role goes beyond day-to-day alert triage, for you will be a technical backbone of the SOC, responsible for onboarding and tuning log sources into SIEM, designing and improving SOC detection and response processes, and leading incident response for escalated security events. You'll work closely with IT/infrastructure, Security teams, and NOC to ensure the SOC has the visibility and processes it needs to detect and respond to threats effectively.

📌 Key Responsibilities:

Log Source Onboarding & Data Engineering

• Own the end-to-end onboarding of new log sources into SIEM, including parsing, field extraction, normalisation, and enrichment
• Design and maintain log pipelines, parsing rules, and data mappings to ensure high-quality, actionable telemetry
• Build and maintain SIEM dashboards, alerts, and detection rules (e.g., SIEM Alerts, TCO optimisation, Data Flow rules)
• Continuously assess log coverage gaps across the environment (endpoint, network, cloud, identity, application) and drive onboarding roadmaps
• Optimise log volume, retention, and cost management within SIEM (TCO tiers, quota management)
• Validate data integrity and troubleshoot ingestion issues, parsing failures, or delayed telemetry

SOC Process Design & Improvement

• Design, document, and continuously improve SOC operating procedures, escalation matrices, and playbooks
• Develop and maintain detection use cases and correlation logic aligned to MITRE ATT&CK
• Define and track SOC KPIs/metrics (MTTD, MTTR, alert-to-incident ratio, false positive rates)
• Build standard operating procedures (SOPs) for L1 analysts and ensure consistent triage quality
• Support shift handover processes, escalation workflows, and quality assurance reviews of L1 work

Incident Response

• Act as the primary escalation point for incidents
• Lead investigation, containment, eradication, and recovery activities for security incidents
• Perform log correlation, timeline reconstruction, and root cause analysis using SIEM and supporting tools
• Coordinate with IT, DevOps, NOC, and business stakeholders during active incidents
• Author detailed incident reports, post-incident reviews (lessons learned), and drive remediation tracking
• Contribute to and maintain the organisation's Incident Response Plan (IRP)

📌 Required Qualifications

• 3-5+ years of experience in a SOC/ security operations role, with demonstrated progression to L2 or equivalent
• Strong experience with AI usage for SOC automation and detection.
• Hands on expertise with SIEM (such as Splunk, Sentinel, QRadar, Elastic, Datadog) — SIEM experience strongly preferred.
• Proven experience onboarding diverse log sources (firewalls, EDR, cloud platforms, identity providers, network devices, applications) into a SIEM/observability platform
• Solid understanding of incident response frameworks (e.g., NIST 800-61, SANS IR) and hands-on IR experience
• Strong knowledge of MITRE ATT&CK, common attack techniques, and detection engineering concepts
• Experience writing/tuning detection rules, correlation logic, and reducing false positives
• Familiarity with cloud environments (AWS/Azure/GCP) and cloud-native logging
• Scripting/query skills (e.g., DataPrime/Lucene query syntax in SIEM, Python, or similar) for automation and analysis
• Excellent documentation skills to design clear SOC processes, playbooks, and incident reports
• Strong communication skills; comfortable presenting findings to technical and non-technical stakeholders

📌 Benefits:

• 24 working days of paid annual leave
• 6 days of paid sick leave
• Official employment
• Medical insurance
• Coffee zone with fruit & snacks available in the office
• Corporate Lunch provided by the company
• Gym and sports classes
• Healthy and friendly work atmosphere
• Greek and English language classes (partially covered).