Security Engineer (SOC)

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer (SOC) based in Canada. Join a cybersecurity consulting environment focused on protecting IT, OT, cloud, and AI systems against evolving digital threats. As a Security Engineer specializing in Security Operations Center (SOC) technologies, you will lead detection engineering initiatives, strengthen security monitoring, and automate investigation and response workflows. You will work with SIEM, SOAR, EDR, and XDR platforms to improve detection accuracy and operational efficiency. AI-powered tools will support routine analysis and documentation, allowing you to focus on technical validation, strategic improvements, and tailored security solutions. Data confidentiality and responsible AI adoption remain central to every project. This fully remote opportunity combines complex cybersecurity challenges, technical innovation, and the potential for substantial performance-based earnings. Accountabilities: You will develop and optimize SOC capabilities, improve threat detection, and help security teams respond to incidents more effectively. Your responsibilities will include: - Build, operate, and continuously improve SOC platforms, including SIEM, SOAR, EDR, and XDR solutions. - Integrate new log sources by managing parsing, normalization, and data quality. - Develop and optimize detection rules and use cases using Sigma, KQL, and SPL, aligned with the MITRE ATT&CK framework. - Automate security analysis and incident response through playbooks and scripting with Python and PowerShell. - Establish Detection-as-Code pipelines with version control, testing, and CI/CD integration. - Integrate threat intelligence into security monitoring and operational workflows. - Collaborate with security analysts and incident responders to reduce false positives and improve detection quality.

- Provide technical support during security incidents and contribute to effective response activities. - Create and maintain runbooks, use-case documentation, and technical concepts. - Use AI-assisted tools to analyze logs, draft detection rules and playbooks, and produce documentation, ensuring all outputs are critically reviewed and validated before use. - Apply strict data protection practices when using AI tools, preventing unauthorized disclosure and ensuring sensitive customer information is handled appropriately. Requirements: You bring substantial cybersecurity experience, strong technical expertise, and a responsible approach to AI-assisted security work. You should be comfortable working independently in a consulting environment while collaborating with technical teams and stakeholders. The key requirements include: - At least five years of experience in IT or cybersecurity, including several years in architecture or consulting roles. - Broad technical knowledge across networks, endpoints, identity, applications, and cloud environments. - Experience with Zero Trust architectures, network segmentation, and IAM/PAM technologies, including Microsoft Entra ID and Active Directory. - Strong understanding of security frameworks and methodologies, including ISO 27001, BSI IT-Grundschutz, NIST CSF, MITRE ATT&CK, and SABSA or TOGAF. - Knowledge of cryptography, public key infrastructure (PKI), and secure application design. - Confident use of AI tools in consulting workflows, including the ability to critically assess their outputs. - Strong awareness of AI-related confidentiality and security risks, including data leakage, model training, and prompt injection. - Willingness to continuously improve processes and products through responsible AI adoption. - Professional fluency in both German and English.