Level 3 Security Operations Center (SOC) Engineer
Future Opportunity — Not Currently Hiring
Position Overview
NOCDOC is seeking a Level 3 SOC Engineer to serve as the senior technical individual contributor within the Security Operations Center (SOC). This role is responsible for advanced security investigations, detection engineering, threat hunting, security tooling improvements, incident response support, and development of SOC operational capabilities.
The Level 3 SOC Engineer serves as the highest technical escalation point within SOC operations, providing expertise during complex security investigations and helping improve detection effectiveness, response capability, security maturity, and customer protection.
This role works closely with SOC leadership, SOC analysts, NOC, Service Desk, Engineering teams, Compliance & Risk, Automation & Integration Engineering, and clients to develop advanced security capabilities, improve operational workflows, strengthen security controls, and enhance NOCDOC’s managed security services.
The ideal candidate is an experienced security professional who combines deep technical expertise with strong analytical ability, documentation discipline, security-focused thinking, and a passion for mentoring others while continuously improving security operations.
Key Responsibilities
Advanced Security Monitoring & Incident Response
- Serve as the highest technical escalation point within SOC operations, including direct phone support for the most complex and customer-impacting security incidents
- Own escalated security tickets through to resolution, ensuring accurate documentation and timely closure in accordance with SLA requirements
- Lead complex security investigations involving advanced threats, suspicious activity, compromised accounts, endpoint incidents, and multi-stage attacks
- Analyze security events using SIEM, EDR, XDR, logs, telemetry, threat intelligence sources, and security analytics platforms
- Support incident response activities including investigation, containment, remediation support, recovery coordination, and post-incident review
- Provide technical leadership during significant security incidents and customer-impacting events
- Develop investigation approaches for complex and emerging threats
- Validate security controls and identify opportunities to improve detection and response effectiveness
Detection Engineering
- Design, develop, test, and maintain security detections across SIEM, EDR, XDR, and related security platforms
- Improve detection coverage by identifying visibility gaps and developing new detection capabilities
- Tune existing detections to improve accuracy, reduce false positives, and increase analyst efficiency
- Develop correlation rules, analytics, detection logic, and automated response workflows
- Validate detection effectiveness through testing, threat simulation, and continuous improvement activities
- Map detection capabilities against attacker behaviors using frameworks such as MITRE ATT&CK
- Document detection methodologies, operational procedures, and response guidance
Threat Hunting & Security Research
- Conduct proactive threat hunting activities to identify malicious activity not detected through standard monitoring processes
- Analyze threat intelligence, vulnerabilities, attacker techniques, and emerging security trends
- Research attacker tactics, techniques, and procedures (TTPs)
- Develop hunting methodologies, investigation guides, and research documentation
- Identify security control gaps and recommend improvements
- Share findings and recommendations with SOC leadership, engineering teams, and customers when appropriate
- Contribute to improving SOC readiness against evolving threats
Security Tooling & Platform Improvement
- Provide technical expertise for SOC security platforms and operational tooling
- Support improvements to SIEM, SOAR, EDR, XDR, vulnerability management, and security monitoring capabilities
- Identify opportunities to improve automation, workflows, and operational efficiency
- Partner with Automation & Integration Engineering on security-related automation opportunities
- Support evaluation, implementation, and optimization of security technologies
- Assist with security platform configuration improvements and operational maturity initiatives
Security Control Improvement & Compliance Support
- Support security control validation activities aligned with CIS Controls, NIST Cybersecurity Framework concepts, and customer security requirements
- Assist with improving security visibility, monitoring coverage, and control effectiveness
- Support evidence collection and documentation requirements for security assessments and audits
- Identify opportunities to strengthen preventive, detective, and response capabilities
- Collaborate with Compliance & Risk teams to improve security program maturity
Technical Leadership & Mentorship
- Mentor Level 1 SOC Analysts and Level 2 SOC Engineers through coaching, knowledge sharing, and technical guidance
- Support development of analyst investigation skills and security operations capabilities
- Contribute to SOC training initiatives, technical development programs, and continuous learning activities
- Develop investigation guides, playbooks, detection standards, and operational documentation
- Promote consistent technical standards and security operations best practices
- Support SOC leadership initiatives related to team maturity, capability development, and service improvement
Documentation & Knowledge Management
- Maintain advanced investigation procedures, detection documentation, security playbooks, and operational standards
- Ensure security knowledge is captured and accessible to SOC team members
- Improve SOC documentation standards and operational consistency
- Maintain accurate incident documentation including investigation findings, timelines, response actions, and lessons learned
- Support compliance activities through accurate security documentation and evidence collection
Cross-Functional Collaboration
- Collaborate with Compliance & Risk teams on security evidence, control validation, and audit support
- Partner with NOC and Service Desk teams on security-related operational issues
- Provide technical expertise for client security discussions and security improvement recommendations
- Collaborate with Engineering teams on security architecture, tooling improvements, and operational enhancements
- Contribute technical input into managed security service improvements and customer security initiatives
Required Qualifications
- Significant experience in security operations, incident response, threat detection, threat hunting, or security engineering
- Advanced understanding of security monitoring, investigation techniques, and incident response processes
- Experience developing, tuning, and validating security detections
- Strong understanding of SIEM, EDR, XDR, SOAR, or related security technologies
- Experience analyzing logs, endpoint telemetry, network activity, identity activity, and security events
- Experience investigating security incidents from detection through remediation support
- Strong understanding of cybersecurity concepts including authentication, access control, endpoint security, vulnerability management, and threat intelligence
- Strong troubleshooting, analytical, and problem-solving skills
- Strong technical documentation and communication skills
- Ability to mentor technical team members and improve analyst capability
Preferred Qualifications
- Experience working in a Managed Security Service Provider (MSSP) or enterprise SOC environment.
- Experience supporting multiple customer security environments.
- Experience with Microsoft security technologies, SIEM platforms, SOAR platforms, or XDR solutions.
- Experience with Microsoft Defender, Sentinel, CrowdStrike, SentinelOne, or similar security platforms.
- Experience with threat hunting methodologies and threat intelligence analysis.
- Experience with scripting or automation using PowerShell, Python, KQL, or similar technologies.
- Experience developing detection content, security playbooks, and response procedures.
- Experience supporting customer security assessments and security improvement initiatives.
- Experience using security frameworks including CIS Controls, NIST Cybersecurity Framework, MITRE ATT&CK, or similar standards to evaluate security posture and improve security operations.
- GIAC Certified Incident Handler (GCIH)
- GIAC Certified Enterprise Defender (GCED)
- GIAC Certified Intrusion Analyst (GCIA)
- Certified Information Systems Security Professional (CISSP)
- Offensive Security Certified Professional (OSCP)
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- CompTIA Security+
- CompTIA CySA+
- Certified Ethical Hacker (CEH)
Technical Skills
Security Operations
- Security monitoring
- Incident response
- Security investigations
- Threat detection
- Threat hunting
- Threat intelligence analysis
- Security event analysis
- Digital investigation concepts
- Malware analysis concepts
Security Frameworks & Threat Models
- CIS Controls
- MITRE ATT&CK Framework
- NIST Cybersecurity Framework concepts
- Security control validation
- Detection coverage mapping
- Risk-based security improvement
Security Platforms
- SIEM platforms
- EDR/XDR platforms
- SOAR platforms
- Security analytics
- Log analysis
- Endpoint telemetry
- Network security monitoring
- Vulnerability management platforms
Detection Engineering
- Detection development
- Correlation rules
- Alert tuning
- KQL or query languages
- Detection testing
- Threat behavior analysis
- Security automation concepts
Security Engineering
- Security tooling improvement
- Security workflow development
- Scripting and automation
- Security architecture concepts
- Documentation development
- Security process improvement
Professional Skills
- Analytical thinking
- Problem solving
- Communication
- Technical leadership
- Mentorship
- Documentation discipline
- Collaboration
- Attention to detail
- Continuous learning mindset
- Ability to explain complex technical concepts
Success Measures
Success in this role will be demonstrated through:
- Improved SOC detection coverage, accuracy, and effectiveness
- Successful handling of complex security investigations and incidents
- Reduced false positives and improved alert quality
- Increased analyst capability through mentorship and knowledge sharing
- Improved security playbooks, procedures, and documentation
- Increased automation and operational efficiency within SOC processes
- Improved alignment between security operations and CIS Controls objectives
- Strong contribution to SOC maturity, service quality, and customer confidence
Career Growth Opportunity
This role provides opportunities to grow into Senior Security Engineer, Detection Engineering Lead, Threat Hunter, Security Architect, SOC Leadership, Security Operations Manager, or specialized cybersecurity roles as technical expertise and leadership capabilities expand.
Schedule
This position supports a 24×7 Security Operations Center environment. Candidates must be available for:
- Scheduled operational coverage as required
- Participation in escalations and major security incidents
- On-call rotation responsibilities
- Occasional after-hours support based on business needs
Benefits
Benefits include:
Medical insurance
Dental insurance
Vision insurance
401(k)
Life insurance
Remote and hybrid work opportunities
About NOCDOC
NOCDOC is a U.S.-based technology operations company with more than 35 years of experience delivering Security Operations Center (SOC), Network Operations Center (NOC), Service Desk, Network Engineering, Automation, and Managed Security Services.
Supporting organizations across North America and internationally, NOCDOC delivers responsive, customer-focused technology operations that help businesses improve reliability, security, and operational efficiency.
At NOCDOC, we invest in our people through continuous learning, mentorship, and career development, providing opportunities to grow into advanced engineering, automation, architecture, and technical leadership roles.