Security Operations Engineer

EPI Company

. Act as a central point of contact for alert triage, incident identification and security event investigation across EPI environments .

Posted 9/23/2026full-timeRemote • France, Germany, SpainMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in cybersecurity, particularly in SOC operations, incident response, and threat hunting. Proficient in log analysis, detection engineering, and utilizing frameworks like MITRE ATT&CK to enhance security posture.

Highest-signal resume keywords

SOC OperationsIncident ResponseThreat HuntingDetection EngineeringLog Analysis

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

PythonPowerShellKQLLog ParsingDetection EngineeringAlert TuningThreat IntelligenceIncident Response PlaybooksAutomation WorkflowsMITRE ATT&CK

Soft Skills

Strong Communication Skills

Tools & Technologies

SIEMEDRAWSAzureRapid7Microsoft Entra ID

Certifications & Qualifications

GSECGCIHBTL1/2SC-200AZ-500

Industry Keywords

CybersecurityPaymentsBankingFintechRegulated Environment

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityPython

About the role

Key responsibilities & impact

Act as a central point of contact for alert triage, incident identification and security event investigation across EPI environments
Execute incident response activities using structured frameworks such as SANS PICERL
Conduct proactive, hypothesis-driven threat hunts based on attacker behaviour, emerging threats, threat intelligence and MITRE ATT&CK techniques
Parse, analyse and correlate logs from authentication, application, system, endpoint and cloud telemetry sources, including AWS and Azure
Design, tune and maintain detection rules, use cases, dashboards, custom alerts and automation workflows
Contribute to SOC playbooks, runbooks, SIEM and EDR integrations
Document and communicate threat findings, incident outcomes and remediation recommendations
Collaborate with engineering, SOC, IR and IT teams to improve detection coverage, response readiness and operational resilience

Requirements

What you’ll need

+5 years of experience in cybersecurity, with strong hands-on experience as a SOC analyst, incident responder, detection engineer or similar role
Fluent in English (CEFR C1 or C2); French, German, Dutch or other European languages are a plus
Strong familiarity with the full SOC lifecycle, from Tier 1 to Tier 3, including alert triage, incident response, threat hunting and threat intelligence
Proven experience in threat hunting, detection engineering or threat intelligence
Solid understanding of SIEM and EDR technologies, log parsing, detection engineering and alert tuning
Hands-on experience with Python, PowerShell or KQL
Ability to analyse and correlate logs from authentication, application, system and cloud telemetry across AWS and Azure
Knowledge of attacker TTPs, MITRE ATT&CK, threat exposure and attack path analysis
Experience creating or improving incident response playbooks, runbooks and automation workflows
Strong communication skills with technical and non-technical stakeholders
Willingness to participate in a 24/7 on-call rotation, approximately one week per month
Experience with Rapid7 and TaHiTI is a nice-to-have
Familiarity with Microsoft Entra ID is a nice-to-have
GSEC, GCIH, BTL1/2, SC-200 or AZ-500 certifications are nice-to-have
Experience in payments, banking, fintech or another highly regulated environment is a nice-to-have

Benefits

Comp & perks

Remote-first culture with quarterly and annual all-staff in-person meetups
Possibility to work from another EU country for up to 3 months per year
Competitive compensation package featuring salary and performance-based bonus
High-quality benefits programme
Learning & development budget: €5,000 training budget per year