Security Operations Engineer

Role Overview

Join Alpaca as a Security Operations Engineer to mature day-to-day security operations. You will manage the company’s third-party SOC relationship, run and tune an on-prem SIEM, and act as the key bridge between IT Helpdesk and the Security team.

Key Missions

• Third-party SOC / SOC partner management: improve alert quality, define and refine escalation workflows, and continuously enhance detection coverage.
• SIEM operations & tuning (on-prem): handle log onboarding, parsing, normalization, correlation rules, and alert tuning.
• Security liaison to IT Helpdesk: triage, prioritize, and resolve security-related tickets efficiently without slowing business.

Responsibilities

• Operate security monitoring and detection pipelines across multiple sources (identity, endpoint, network, cloud).
• Lead calm, decisive incident handling and cross-functional coordination during escalations.
• Collaborate with IT, DevOps, Engineering, and the external SOC partner.

Requirements

• Hands-on SIEM operation and tuning (on-prem or cloud).
• 3+ years in Security Operations.
• Linux experience.
• Scripting/automation for security operations tasks: Python and/or Bash.
• Experience working with a third-party SOC/MSSP.
• Familiarity with endpoint security, identity monitoring, and log-based detections.
• Strong incident response and alert investigation skills across identity, endpoint, network, and cloud.
• Understanding of attacker techniques and detection methodologies; experience with MITRE ATT&CK.
• Experience working closely with IT/helpdesk and translating security requirements into operational workflows.
• Strong written and verbal communication, especially during incidents.

Nice-to-Haves

• Hands-on experience maintaining Kubernetes clusters.
• Experience securing financial/trading/regulated platforms.
• Compliance familiarity: SOC 2, ISO 27001, PCI.
• Cloud security logging/telemetry knowledge (AWS/GCP/Azure) and SaaS security telemetry.
• Security certifications (e.g., GCIA, GCIH, GCED, CISSP, or similar).
• Experience with GitOps and CI/CD pipelines.
• Experience running tabletop exercises or incident response simulations.
• Ability to balance security rigor with operational efficiency.