Security Operations Engineer
Overview:
In this role, you'll design and tune detections in a Microsoft Sentinel–driven environment and build SOAR automation to keep a lean security team ahead of threats. You'll own detection engineering for MasterMind, Mastery's Azure-native TMS, and close visibility gaps across AKS, endpoints, and network telemetry. You'll work hands-on with analytics rules, threat context, and automation to reduce noise and triage time, partnering with cross-functional teams. This is a deeply technical, individual-contributor role focused on shipping detections and automation that scale with the platform. Compensation / Benefits Medical, Dental & VisionLife & AD&D Insurance Legal & Employee Assistance 401(k) with 4% Match Flexible PTOGiving Back — St. Jude Children's Research Hospital
Responsibilities:
- Design, write, and tune analytics rules and correlation logic in Microsoft Sentinel aligned to MITRE ATT&CKClose visibility gaps across infrastructure and telemetry as new log sources come online
- Refine detections to reduce false positives while preserving real signals
- Design and build SOAR playbooks and workflows to automate triage, enrichment, and response
- Integrate Sentinel, Defender, and other security tools via APIs and scripting
- Translate emerging threats into actionable, tuned detection logic and stay hands-on with Sentinel/SOAR capabilities
Key requirements:
- 4+ years in security operations or detection engineering
- Hands-on experience building or tuning detection rules in a SIEM (Sentinel strongly preferred)
- Experience building SOAR playbooks or security automation workflows
- Fluent in KQL or equivalent SIEM query language
- Scripting and API proficiency (Python or PowerShell) for automation and REST API integrations
- Self-directed, independent work styleself-directedhighly analyticalproblem-solving orientationKQL fluency
- Microsoft SentinelSOAR automation