Senior SOC Engineer

This advert was translated automatically from Portuguese. Read the original.

Do you want to join one of the largest professional services organisations on the market? Then Deloitte is for you. Here, you will have the opportunity to boost your career and strengthen your skills in our technology universe. We are an international Tech Hub and we are looking for the best Cybersecurity specialists to join our centres of excellence and our community. At Deloitte, you will transform the world as we know it and develop unique and innovative solutions across the most varied and complex transformation projects, from Portugal to the world. We are strengthening our Cyber area and we are looking for experienced professionals who have a natural aptitude and enjoyment for working in a team and in a multi-project environment. You can discover all the functions you will perform, according to your profile, so that you can take a leap in your career! Join us? We are waiting for you. Your day-to-day and responsibilities: The Senior SOC Engineer is responsible for designing, implementing, optimising and maintaining the technologies that enable the Security Operations Center to effectively detect, analyse and respond to threats. This role is focused on SIEM engineering, EDR optimisation, SOAR automation, log ingestion, use case development and platform reliability in cloud and on-premises environments. SIEM Engineering - Architect, implement and maintain SIEM platforms. - Develop and optimise data ingestion pipelines (Syslog, API, Event Hubs, Logstash, Agents). - Create detection rules using KQL, SPL, AQL, EQL, Sigma and Analytics Rules. - Implement normalisation, parsing, enrichment and correlation logic. - Ensure the integration of new log sources, the monitoring of their health and the completeness of telemetry. EDR / XDR Engineering - Administer and optimise EDR platforms. - Develop custom policies, behavioural detections and response actions. - Monitor sensor health, coverage and integration with SIEM/SOAR. SOAR Automation - Design and maintain playbooks and workflows. - Automate repetitive processes, namely enrichment, triage, notifications and containment. - Integrate SOAR platforms with ITSM tools (ServiceNow, Jira), EDR, firewalls and threat intelligence platforms. Security Engineering and Architecture - Integrate threat intelligence feeds (STIX/TAXII, MISP, Anomali). - Collaborate with threat hunting teams, SOC analysts and DFIR teams to develop new detection capabilities. - Maintain documentation, architecture diagrams and platform standards. - Ensure compliance with log, retention and audit requirements (ISO 27001, SOC 2, NIST). Operational Support - Resolve issues related to log ingestion, detection failures and platform performance. - Support purple team exercises and detection coverage assessments (MITRE ATT&CK mapping). - Participate in the on-call rotation for escalations related to security platforms. Are you the person we are looking for? - Advanced knowledge of network protocols, system architectures (Linux/Windows) and cloud environments (AWS, Azure, GCP); - In-depth knowledge of log sources, normalisation, parsing and enrichment; - Solid experience with SIEM platforms (architecture, integration, scalability and performance optimisation); - Ability to design, develop and maintain SIEM infrastructures and logging pipelines; - Implement log ingestion pipelines (e.g. syslog, APIs, agents) ensuring data quality; - Integrate SIEM with other security tools (SOAR, EDR and Threat Intelligence platforms); - Solid scripting skills (Python, Bash and PowerShell) for task automation and data processing; - Apply security frameworks (MITRE ATT&CK, NIST) in the development of use cases for detection; - Collaborate with SOC analysts to improve detection coverage and reduce false positives; - Perform gap analyses and promote the continuous improvement of monitoring capabilities; - Optimise SIEM queries, storage and cost efficiency; - Ensure the scalability, reliability and high availability of the SIEM platform; - Degree or equivalent professional experience (minimum of 1 year in similar roles); - Relevant Cybersecurity certifications and training will be valued; - Fluency in English, both written and spoken; - Ability to work on multiple projects simultaneously and a strong focus on excellence in customer service; - Strong analytical and problem-solving skills; - Good communication, technical writing and presentation skills. Develop a career tailored to you - In a diverse working context that allows for continuous development and learning; - Through a personalised career development plan (skills/technical and functional opportunities), suited to the moment, your needs and goals; - By participating in national and international projects, with relevant scale and impact in this area of specialisation; - Unlimited access to the largest online learning platforms (LinkedIn Learning and Udemy); - Opportunity for training and certifications in the latest technologies, namely in Cloud technologies. Experience a culture of unity - A culture of innovation and excellence that makes us leaders and pioneers of trends; - A friendly environment of respect, trust, transparency and informality; - A network for life that keeps you connected to the best knowledge alongside leaders and specialists; - An opportunity to be part of our communities (Tech, innovation, sport and other interests) and to actively participate in social responsibility projects. About Deloitte At Deloitte you will never work alone. You will have the opportunity to join various transformation projects and be part of a team that will inspire you and help you develop differentiating solutions, in a dynamic and collaborative environment where you can give your best and benefit from our wellbeing and flexibility initiatives. We are more than 5,500 people in Portugal, of which more than 2,600 work in technology areas, from offices and Digital Studios in Lisbon, Porto, Braga, Viseu, Coimbra and Faro and from technology hubs in Braga. In addition, our teams in Portugal have an international reach, which demonstrates our strong global leadership in low code/no code, telecommunications network engineering, organisational transformation technology platforms (ServiceNow and Apptio) and the financial services industry (Finastra, TIA and Guidewire). If you are interested in exploring and developing your skills in any of these areas in technology solutions – software engineering, cloud, systems integration, data analytics & data science, cyber risk, telecommunications network engineering, UX design – and would like to work with technologies such as AWS, Google, Oracle, Salesforce, SAP, Mulesoft, Feedzai and SAS, among others, then you are in the right place! Find out more at www.deloitte.com/pt/careers. Keywords: - About Deloitte; Consulting; Technology - LI-HYBRID #LI-CA1 - TECHDTT #Experienced