SOC Specialist, Interactive Brokers

• The ideal candidate is passionate about improving SOC effectiveness through better detection logic, SIEM/XDR optimization, automation, threat detection engineering, and operational process improvements
• This position requires hands-on experience with enterprise security technologies, log analytics, threat detection, incident investigations, and security automation platforms
• Overall 8+ years of experience of which 3+ years of experience in a Security Operations Center (SOC), Detection Engineering, Incident Response, or Cyber Defense role
• Strong understanding of incident detection, triage, investigation, containment, and response processes
• Experience analyzing security events from multiple data sources including endpoints, network devices, cloud platforms, and identity providers
• Hands-on experience with one or more SIEM platforms: Splunk Enterprise Security, Sentinel One Singularity Data Lake, Microsoft Sentinel, QRadar, LogRhythm, Elastic Security, Google Chronicl
• Which skills are required? Palo Alto Networks, Cisco Security products, Fortinet, Check Point, Zscaler, Cloud Security
• Experience monitoring and securing cloud environments: AWS, Microsoft Azure, Google Cloud Platform (GCP)
• Understanding of: cloud-native security controls, IAM, cloud logging and monitoring, cloud threat detection
• Strong working knowledge of: Windows Server, Active Directory, Microsoft Entra ID (Azure AD), Linux administration and security
• Experience developing automation using: Python, PowerShell, Bash, C#
• Ability to: consume APIs, automate security workflows, build integrations between security platforms
• Knowledge of: MITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, Incident Response Lifecycle, Detection Engineering principles
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field, or equivalent practical experience
• Self-motivated and able to handle tasks with minimal supervision
• Superb analytical and problem-solving skills
• Excellent collaboration and communication (verbal and written) skills
• Outstanding organizational and time management skills

Desirable

• We are seeking an experienced SOC Specialist to help strengthen, modernize, and optimize our Security Operations capabilities
• This role sits at the intersection of security operations, detection engineering, security automation, and incident response
• You will play a key role in reducing alert fatigue, improving signal-to-noise ratio, accelerating response times, and enhancing overall security visibility across the enterprise
• Monitor, analyze, investigate, and respond to security alerts and incidents across enterprise environments
• Perform triage and escalation of security events in accordance with incident response procedures
• Conduct root cause analysis and document findings, containment actions, and remediation recommendations
• Participate in incident response activities, including malware investigations, insider threat investigations, and account compromise incidents
• Support threat hunting and proactive detection activities
• Develop, tune, and optimize SIEM detection rules, correlation searches, analytics, and alerting mechanisms
• Create and maintain high-fidelity detections mapped to MITRE ATT&CK techniques and adversary behaviors
• Continuously improve detection coverage across endpoints, cloud platforms, identity systems, networks, and applications
• Measure and improve detection effectiveness through detection engineering metrics and validation exercises
• Reduce false positives and improve alert quality through continuous tuning and optimization
• Administer and optimize security monitoring platforms including SIEM, XDR, EDR, NDR, and cloud security tooling
• Maintain log ingestion pipelines, data normalization, parsing, enrichment, and retention strategies
• Validate health, performance, and scalability of security monitoring infrastructure
• Collaborate with infrastructure, cloud, and application teams to onboard new log sources and security telemetry
• Design, develop, and maintain SOAR playbooks and automated response workflows
• Automate repetitive SOC tasks to improve analyst efficiency and reduce response times
• Integrate security tools using APIs, scripting, and workflow orchestration platforms
• Develop automated enrichment, containment, and investigation processes
• Leverage threat intelligence feeds and indicators of compromise (IOCs) to improve detection capabilities
• Conduct threat hunting activities using endpoint, network, cloud, and identity telemetry
• Research emerging threats, attacker techniques, and vulnerabilities affecting the organization
• Assist with purple team exercises and detection validation efforts
• Identify opportunities to improve SOC processes, workflows, runbooks, and operational metrics
• Develop and maintain SOC documentation, playbooks, and standard operating procedures
• Support vulnerability management initiatives and risk-based remediation efforts
• Contribute to SOC maturity improvements aligned with industry frameworks and best practices