FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in Security Operations, including SIEM and SOAR capabilities, with a strong focus on alert investigation, incident response, and automation. Proficient in developing detection rules and maintaining security metrics while collaborating effectively across teams.
Highest-signal resume keywords
SIEM Operation and TuningSOAR Playbook DevelopmentScripting in Python and BashAlert Investigation SkillsSecurity Certifications (GCIA, GCIH, GCED)
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
SIEMSOARLog ParsingDetection RulesIncident ResponseThreat IntelligenceCloud Security LoggingDetection-as-CodeGitOpsCI/CD Pipelines
Soft Skills
Strong Written CommunicationStrong Verbal CommunicationCross-Functional CollaborationCalm Under PressureDecisive Handling of Escalations
Tools & Technologies
LinuxAWSGCPAzureKubernetesManaged SOCMSSP
Certifications & Qualifications
GCIAGCIHGCED
Industry Keywords
Security OperationsIncident ResponseCompliance FrameworksSOC 2ISO 27001Financial SecurityTrading PlatformsRegulated Platforms
Tech Stack
Tools & technologiesAWSAzureCloudGoogle Cloud PlatformKubernetesLinuxPython
About the role
Key responsibilities & impact- Own the daily operation and continuous improvement of Alpaca’s SIEM and SOAR capabilities
- Onboard security logs across cloud, identity, endpoint, SaaS, and application systems, including parsing, normalization, and data quality checks
- Build, test, and tune detection rules based on threat intelligence, incident learnings, and emerging attack techniques, mapped to frameworks such as MITRE ATT&CK
- Tune, enrich, and manage the lifecycle of detections so alerts stay actionable
- Maintain detections for critical systems and priority attack techniques
- Build and maintain dashboards for alert volume, ingest health, and response status
- Support security incidents with evidence collection, detection queries, and containment actions
- Develop and improve alert-handling and incident response runbooks and escalation paths
- Track and report security operations metrics, including MTTD and MTTR
- Participate in the Security Operations on-call rotation after onboarding and cross-training
- Design, build, and maintain SOAR playbooks automating enrichment, containment, ticketing, and notification
- Triage, investigate, and respond to security alerts across endpoints, identity, cloud, network, and application logs
- Run hypothesis-driven threat hunts and turn findings into new detections
- Report to the Enterprise Security Architect and collaborate with Security, IT, DevOps, Engineering, and external partners
Requirements
What you’ll need- 3+ years of experience in Security Operations or detection engineering roles
- Hands-on experience operating and tuning a SIEM
- Experience building SOAR playbooks or equivalent response automation
- Working with Linux
- Scripting or automation experience (Python, Bash) for security operations tasks
- Experience onboarding and parsing log sources from cloud, identity, and SaaS platforms
- Strong alert investigation skills across identity, endpoint, network, and cloud environments
- Understanding of common attacker techniques and detection methodologies
- Experience supporting security incidents, including evidence collection, detection queries, and containment
- Willing to participate in an on-call rotation
- Strong written and verbal communication skills, especially during incidents
- Comfortable working cross-functionally and handling escalations calmly and decisively
- Experience securing financial, trading, or other highly regulated platforms
- Familiarity with compliance frameworks such as SOC 2 or ISO 27001
- Experience with detection-as-code, GitOps, and CI/CD pipelines
- Knowledge of cloud security logging (AWS/GCP/Azure) and SaaS security telemetry
- Familiarity with Kubernetes-hosted security tooling
- Experience working with a managed SOC or MSSP
- Security certifications (GCIA, GCIH, GCED, or similar)
- Ability to balance security rigor with operational efficiency and business needs
Benefits
Comp & perks- Competitive Salary & Stock Options
- Health Benefits
- New Hire Home-Office Setup: One-time USD $500
- Monthly Stipend: USD $150 per month via a Brex Card