SOC/SIEM Security Expert - L3

Role Summary: The L3 SOC/SIEM Security Expert is a subject matter expert responsible for advanced threat hunting, complex incident response, SIEM engineering, and developing sophisticated detection and prevention strategies.

Key Responsibilities:

• Lead complex security incident investigations and advanced threat hunting operations.
• Design, implement, and optimize SIEM use cases, correlation rules, and dashboards.
• Develop custom scripts and tools for security automation and analysis.
• Act as a technical lead for security projects and initiatives within the SOC.
• Provide expert guidance on security architecture and control implementation.
• Stay abreast of emerging threats and security technologies.

Essential Qualifications:

• Relevant Experience: 5-8 years in a senior SOC, incident response, or SIEM engineering role, with a proven track record of leading complex security initiatives.
• Certifications (Optional/Good to Have): GIAC GCIH, GCFA, CISSP, advanced vendor-specific SIEM certifications.
• Typical Skills:
• Expertise in SIEM administration, content development, and optimization (e.g., Splunk ES, QRadar, Elastic Stack).
• Deep understanding of adversary tactics, techniques, and procedures (TTPs).
• Proficiency in scripting/programming (e.g., Python) for security automation and data analysis.
• Experience with cloud security concepts and technologies (if applicable to the telecom environment).
• Strong knowledge of network security architectures, including advanced firewall, IPS, and DDoS mitigation strategies.
• Communication Skills: Excellent written communication for architectural documentation, strategic reports, and technical guidance; strong verbal communication for presenting complex findings and leading technical discussions.
• Analytical Skills: Exceptional analytical, problem-solving, and strategic thinking skills to anticipate threats, design robust defences, and lead complex investigations.
• Basic Telecom Network Knowledge: In-depth understanding of telecom network architecture, including IGW operations, transit IP, mobile core, and how security controls integrate and impact these critical functions.

Work Location: In person