Senior Security Engineer (L3 SOC)

Role Summary

The Senior Security Engineer (L3) serves as the highest technical escalation point for customer-facing security operations. The role is responsible for advanced threat investigation, incident response, threat hunting, security engineering, detection engineering, and continuous security improvement initiatives.

Unlike traditional SOC analyst roles, this position focuses on complex investigations, customer consultation, security use case development, and improving the overall effectiveness of security monitoring platforms.

Key Responsibilities

Security Operations

• Perform advanced investigation and validation of security incidents escalated from L1/L2 teams.
• Lead root cause analysis (RCA) for major security incidents.
• Provide recommendations and remediation guidance to customers.
• Support incident coordination during high-severity security events.

Threat Hunting

• Conduct proactive threat hunting activities.
• Research emerging threats, attack techniques, and adversary TTPs.
• Develop hunting queries and methodologies using MITRE ATT&CK framework.

Detection Engineering

• Design and develop SIEM detection rules and analytics.
• Improve alert quality through tuning and optimization.
• Create use cases, correlation rules, watchlists, and detection content.
• Validate data source coverage and logging requirements.

Security Platform Engineering

• Support deployment and optimization of Microsoft Sentinel and related security technologies.
• Assist with onboarding new log sources and integrations.
• Develop automation and response playbooks.
• Perform log analysis and data normalization activities.

Customer Engagement

• Participate in customer security reviews and technical workshops.
• Present investigation findings and technical recommendations.
• Act as trusted advisor for security monitoring improvements.
• Support onboarding of new customers and services.

Knowledge & Quality Management

• Review investigation quality and SOC processes.
• Mentor junior analysts and engineers.
• Develop SOPs, playbooks, and technical documentation.
• Share security knowledge across SOC teams.

Required Technical Skills

Security Operations

• Incident Response
• Digital Forensics fundamentals
• Malware Analysis fundamentals
• Threat Hunting
• Security Monitoring

SIEM/XDR Platforms

• Microsoft Sentinel
• Microsoft Defender XDR
• Microsoft Defender for Endpoint
• KQL (Kusto Query Language)

Infrastructure Knowledge

• Windows Security
• Linux Security
• Active Directory
• Azure / Cloud Security
• Networking Fundamentals

Detection Engineering

• MITRE ATT&CK
• Rule Development
• Use Case Development
• Log Analysis
• Threat Intelligence Integration

Preferred Certifications

• SC-200
• AZ-500
• SC-100
• GCIA / GCIH

Experience

• 5+ years in Security Operations.
• 2+ years in SIEM engineering or threat hunting.
• Proven experience with large enterprise security environments.
• Experience in customer-facing consulting and incident response activities.