> Markdown version of [/jobs/ext/3014362-exabeam-engineer](https://www.wearedevelopers.com/jobs/ext/3014362-exabeam-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Exabeam Engineer

- **Company:** ACCRESCENT INVESTMENT GROUPS LLC
- **Location:** Dallas, TX, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Cyber Security, Intrusion Detection and Prevention, Log Analysis, Security Information and Event Management, Mitre Att&ck, Cyber Threat Analysis, Cybercrime
- **Published:** September 20, 2026
- **Apply:** https://www.wayup.com/i-j-Exabeam-Engineer-Accrescent-Group-522110845702036/

## About the Role

+ Minimum 4 years of core SOC experience.
 + Mandatory hands-on experience with Exabeam SIEM and UEBA.
 + Strong experience in:
o Security Monitoring & Incident Response
o Threat Hunting
o Detection Engineering
o Security Event Correlation & Log Analysis
o Threat Intelligence Operations
o MITRE ATT&CK Framework
o IOC/IOA Analysis
o Root Cause Analysis

 + Experience with:
o Must have: Exabeam
o Good to have: Anomali

## Description

We are seeking a Senior SOC Analyst / Lead SOC Analyst with strong hands-on expertise in Exabeam SIEM and UEBA to serve as the primary onshore Security Operations resource supporting a strategic customer environment. This individual will lead advanced incident investigations, threat hunting, detection engineering, and incident response activities while acting as the day-to-day SOC representative for the customer.
The ideal candidate will be comfortable operating in a customer-facing role, engaging directly with the customer's CISO organization, leading critical security incidents, and driving improvements across detection and response capabilities.
Key Responsibilities

 + Monitor, investigate, and respond to security alerts and incidents using Exabeam SIEM and UEBA.
 + Lead advanced incident investigations, including root cause analysis, containment, eradication, recovery, and post-incident reviews.
 + Serve as the primary SOC point of contact for the customer and represent SOC operations in day-to-day engagements.
 + Act as the Incident Responder and Commander during high-priority security incidents, coordinating response activities across multiple teams.
 + Develop, tune, and optimize Exabeam correlation rules, behavioral analytics use cases, dashboards, and detection content.
 + Conduct proactive threat hunting activities leveraging security telemetry, UEBA insights, and threat intelligence.
 + Leverage Anomali threat intelligence to enrich investigations and improve detection effectiveness.
 + Map detections and investigations to the MITRE ATT&CK framework.
 + Collaborate with onshore and offshore SOC teams, as well as infrastructure, network, cloud, and application teams.
 + Produce executive and technical incident reports, threat trend analysis, and operational metrics.


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Progressive Delivery in Kubernetes](https://www.wearedevelopers.com/videos/949-progressive-delivery-in-kubernetes)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [APItoolkit: Using Merkle Trees and LLMs to Detect the UnDetectable in Software Monitoring](https://www.wearedevelopers.com/videos/1639-apitoolkit-using-merkle-trees-and-llms-to-detect-the-undetectable-in-software-monitoring)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [The Geometry of Incidents: Connecting User Impact to Architecture](https://www.wearedevelopers.com/magazine/764-the-geometry-of-incidents-connecting-user-impact-to-architecture)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)