> Markdown version of [/jobs/ext/1507139-security-operations-platform-engineer](https://www.wearedevelopers.com/jobs/ext/1507139-security-operations-platform-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Operations Platform Engineer - **Company:** First Quality Enterprises, Inc. - **Location:** United States (Remote available) - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Amazon Web Services, Microsoft Azure, Software as a Service, Cloud Computing Security, Cyber Security, Data Normalization, Data Reduction, Data Retention, Data Retrieval, Query Languages, Intrusion Detection Systems, JSON, Python (Programming Language), Log Analysis, Network Protocols, Parsing, Windows PowerShell, Security Information and Event Management, Scripting, In-Plane Switching (IPS), Data Ingestion, Mitre Att&ck, Cyber Threat Analysis, Firewalls (Computer Science), Information Technology, Data Pipelines - **Published:** July 30, 2026 - **Apply:** https://firstquality.wd5.myworkdayjobs.com/FIRSTQUALITY/job/US-PA-Home-Office/Security-Operations-Platform-Engineer_R11772 ## About the Role * Bachelor's degree in Cybersecurity, Information Technology, or related field (or equivalent experience) * 3+ years of experience managing a SIEM platform * Knowledge of network protocols, firewalls, IDS/IPS, EDR, cloud security logs * Understanding of data normalization standards (CEF, LEEF, JSON, etc.) * Experience with SIEM query languages * Experience with scripting (Python, PowerShell, or similar) for automation * Working knowledge of MITRE ATT&CK, threat intelligence, and incident response processes * Preferred: 3+ years managing SOAR platform * Preferred: Experience developing automation, and response playbooks * Preferred: Familiarity with Azure, AWS, or GCP log configurations * Preferred: Experience supporting compliance frameworks (NIST, ISO 27001, SOX, HIPAA, etc.) * Preferred: Security+, CySA+, CASP+, GCIA, GCIH, CISSP or equivalent * Analytical and problem-solving skills * Strong troubleshooting and log analysis capabilities * Ability to translate security requirements into technical solutions * Strong communication skills for technical and executive audiences * Ability to work both independently and collaboratively in a fast-paced SOC environment ## Description * Platform Management + Configure and maintain SIEM/SOAR platform + Monitor platform performance, availability, and data health + Review and maintain upgrades, integrations, and ongoing optimization + Manage role/scope-based access controls and data retention policies * Data Ingestion & Integration + Onboard and normalize log sources (firewalls, endpoints, servers, cloud, SaaS, identity providers, etc.) + Build integrations via scripting for custom data onboarding utilizing APIs + Troubleshoot ingestion issues and ensure log integrity and completeness + Review and maintain parsing rules and data mappings + Optimize data pipelines for performance and cost efficiency * SOC Operations Support + Develop, tune, and maintain detection rules logic, and alerting thresholds to improve fidelity and reduce false positives + Collaborate with SOC analysts during active investigations to provide platform support, log extraction, and forensic data retrieval + Vendor management and escalation support * Reporting & Dashboards + Build and maintain dashboards for SOC operations, compliance, and executive reporting + Develop and maintain scheduled and ad-hoc reports for stakeholders + Develop KPIs and metrics for security posture and incident trends * Continuous Improvement + Evaluate new log sources and security integrations + Recommend enhancements to improve visibility and coverage + Stay current on platform updates and best practices + Evaluate existing integrations and data to improve parsing, data normalization, and data reduction ## Related Videos - [Tips and Tricks for Working with JSON](https://www.wearedevelopers.com/videos/1229-tips-and-tricks-for-working-with-json) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Introducing JSON Structure](https://www.wearedevelopers.com/videos/100219-introducing-json-structure) - [Building a Compiler with C#](https://www.wearedevelopers.com/videos/116-building-a-compiler-with-c) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)