Level 3 SOC Engineer

The Level 3 SOC Engineer will strengthen threat detection and incident response across cloud and on-premise customer environments. They will proactively hunt for threats, develop and maintain tailored detection use cases beyond Microsoft’s standard capabilities, and tune rules to reduce false positives and alert fatigue. The role also involves investigating and containing incidents, developing response guides and automated Microsoft Sentinel playbooks, creating dashboards and KPIs, and supporting log source integration, SIEM migrations and SOC implementation.

Key Responsibilities

• Proactively hunt for threats and develop detection use cases tailored to the customer’s environment, extending Microsoft’s existing detection capabilities.
• Maintain and tune detection rules to reduce false positives, alert noise and analyst fatigue.
• Investigate complex incidents and support threat containment, eradication and resolution.
• Develop investigation guides, incident response playbooks and automated playbooks within Microsoft Sentinel.
• Build dashboards and KPIs to demonstrate SOC performance and security value.
• Integrate log sources into the SIEM and support SIEM migrations and SOC implementation.
• Monitor emerging threats and translate findings into detection improvements.

Experience Required

• Strong experience within a Level 3 SOC or detection engineering role.
• Hands-on Microsoft Sentinel experience, including detection rules and automated playbooks.
• Proven experience in threat hunting and incident response.
• Ability to improve detection coverage while reducing unnecessary alerts.
• Experience with SIEM integration, log source onboarding and security monitoring across cloud and on-premise environments.
• Strong communication skills and the ability to explain technical findings clearly.

#J-18808-Ljbffr