Security Operations Center Technical SME

The SOC Technical SME reports directly to the SOC Program Manager and serves as the technical backbone of a 24/7 security operations center, providing deep expertise in log analysis, SIEM administration and tuning, and detection engineering. This role is responsible for interrogating high-volume log sources, identifying gaps in visibility and coverage, and ensuring the toolset and detection logic keep pace with evolving adversary tradecraft., Deeply analyze and interrogate logs across diverse sources (network, host, application, cloud, identity) to identify anomalies, gaps, and indicators of compromise

• Monitor, tune, and optimize SIEM platforms to improve detection fidelity and reduce false positive/negative rates
• Evaluate log volume, retention, and ingestion pipelines to ensure completeness of data and identify blind spots in coverage
• Develop, refine, and maintain correlation rules, use cases, and detection content aligned to current threat intelligence techniques
• Serve as an escalation point for Tier 1/2 analysts on complex triage, investigation, and incident analysis
• Utilize and maintain proficiency across relevant security tool stacks (SIEM, EDR, NDR, SOAR, threat intel platforms, packet capture/analysis tools)
• Support containment, eradication, and recovery efforts during security incidents as a senior technical responder
• Collaborate with the SOC Program Manager to report on SOC metrics, detection coverage, and operational effectiveness
• Recommend and support implementation of process improvements, automation, and playbooks to increase SOC efficiency
• Stay current on emerging threats, adversary TTPs, and industry best practices, incorporating relevant intelligence into detection strategy
• Assist in mentoring and upskilling junior SOC analysts on log analysis and investigative techniques

A degree in Computer Science, Information Systems, Engineering, or a related discipline is preferred. At least seven (7) years of information security experience, with demonstrated depth in SIEM administration/engineering, log analysis, and security tool stacks in a SOC environment. Experience with one or more SIEM platforms (e.g., Splunk, QRadar, Elastic, Sentinel) required. Familiarity with threat intelligence integration strongly preferred. CySA+, GCIA, GCIH, or CISSP required.