SOC & SIEM Operations Developer
Job Description
About the Role
We are looking for a SOC & SIEM Operations Developer with hands-on expertise in Splunk, Microsoft Sentinel, CrowdStrike Falcon to strengthen our client's security posture. This role goes beyond compliance checklists — you'll actively monitor threats, conduct assessments, and implement controls that protect critical business assets. The ideal candidate has experience with Palo Alto Networks and Carbon Black, understands regulatory frameworks (SOC 2, GDPR, HIPAA), and can communicate security risks to both technical teams and business leadership. You'll be the go-to security expert, owning everything from vulnerability management to incident response planning.
Key Responsibilities
- Own Splunk implementation and optimization — configuration, customization, and ongoing enhancement based on business needs
- Manage Microsoft Sentinel workflows including setup, user training, and continuous improvement of processes
- Implement and maintain CrowdStrike Falcon ensuring seamless integration with existing systems and workflows
- Conduct regular security assessments, vulnerability scans, and penetration testing of SOC & SIEM Operations systems
- Monitor security events using SIEM and respond to alerts with documented incident response procedures
- Implement and maintain security controls aligned with SOC 2, ISO 27001, or HIPAA requirements
- Collaborate with development teams to embed security into the SDLC — threat modeling, code review, and testing
- Manage IAM — user provisioning, access reviews, privilege escalation controls, and MFA enforcement
- Maintain SOC & SIEM Operations documentation including security policies, runbooks, and compliance evidence
- Conduct security awareness training and simulated phishing exercises for the organization
Must-Have Qualifications
- Hands-on experience with Splunk — configuration, customization, and troubleshooting in production environments
- Proficiency with Palo Alto Networks as part of the SOC & SIEM Operations development/operations workflow
- 3+ years of hands-on SOC & SIEM Operations security experience in enterprise environments
- Understanding of security frameworks (NIST CSF, ISO 27001, CIS Controls)
- Experience with vulnerability management, penetration testing, or threat hunting
- Knowledge of network security, identity management, and encryption principles
- Excellent documentation skills for policies, procedures, and compliance evidence
Nice-to-Have Skills
- CompTIA Security+ certification or equivalent validated credential
- Splunk Core Certified User certification or equivalent validated credential
- Experience with advanced SOC & SIEM Operations features: Microsoft Sentinel, CrowdStrike Falcon, Threat Hunting
- Familiarity with the broader SOC & SIEM Operations ecosystem including Carbon Black and Tenable
- CISSP, OSCP, CEH, or equivalent security certifications
- Experience with cloud-native security tools and zero-trust architecture
Interview Tips
Technical Coding Exercise
Give a small, realistic SOC & SIEM Operations coding challenge that tests fundamentals — clean code, edge case handling, and test writing. Time-box to 45-60 minutes.
Architecture Whiteboard
Present a system design problem relevant to SOC & SIEM Operations. Evaluate their approach to scalability, data modeling, and trade-off discussions.
Code Review Simulation
Show a SOC & SIEM Operations pull request with both good patterns and subtle issues. Assess what they catch, how they communicate feedback, and what they prioritize.
Past Project Deep-Dive
Have them walk through their most challenging SOC & SIEM Operations project. Ask probing questions about architecture decisions, obstacles, and what they learned.
Typical Team Structure
Team Size
2-5 SOC & SIEM Operations developers
Reports To
Engineering Manager, Tech Lead, or CTO
Collaborates With
Product Management, QA/Testing, DevOps, Design
Related Job Description Templates
Skip the JD — Get Matched Instead
Tell us your SOC & SIEM Operations requirements and we'll send pre-vetted profiles with video intros in 24-48 hours.
You're all set!
We'll send matched profiles within 24-48 hours. Check your email for next steps.