# SOC L2/L3 Engineer

**Company**: Solidgate
**Location**: Europe; Warsaw; Europe; Nicosia; Kyiv; Lviv
**Work arrangement**: remote
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Finance

**Apply**: https://jobs.ashbyhq.com/solidgate/7a0b504d-8bb2-4427-b516-ad80eb8d2a70?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_c26e08d7-b8c

## Description

At Solidgate, our mission is clear: to empower outstanding entrepreneurs to build exceptional internet companies.

We exist to fuel the builders , the ones shaping the digital economy , with the financial infrastructure they deserve.

You will define what detection looks like at Solidgate: what gets monitored, what gets detected, and how the team responds when something goes wrong.

**Responsibilities**

- Build and operationalize the SIEM from PoC to production - including case management and UEBA, with full ownership of the technology selection

- Design, write, and tune detection rules mapped to MITRE ATT&CK, covering identity compromise, privilege escalation, lateral movement, and endpoint threats

- Triage and investigate L2/L3 alerts, reduce false positives, and establish clear escalation paths for each use case

- Lead incident response and basic forensics - containment, eradication, and structured lessons learned

- Onboard log sources across AWS, JumpCloud, Google Workspace, CDE, and SWIFT;

- Run threat hunts based on realistic attack hypotheses specific to a payment platform's risk profile

- Build and maintain runbooks and playbooks; automate repetitive actions via SOAR or scripting

- Define SOC metrics and own monthly reporting to management on detection coverage and response performance

**Requirements**

- 3+ years in SOC / Detection & Response at L2/L3 level, with hands-on investigation experience

- Practical experience building or operating a SIEM, including writing and tuning detection rules

- Detection engineering with MITRE ATT&CK mapping; confident with KQL, SPL, or equivalent query languages

- Experience investigating cloud log sources: AWS CloudTrail, GuardDuty, Google Workspace, EDR/XDR

- Scripting and automation skills (Python or similar) for telemetry processing and routine tasks

- Solid understanding of attacker techniques and how they manifest in logs - not just tool knowledge, but threat understanding

- Structured under pressure: disciplined investigation process, clear documentation, clean post-mortems

**Nice to Have**

- SOAR experience and a detection-as-code approach (version control for rules, CI pipelines for detection)

- UEBA, threat intelligence enrichment, or alert contextualization at scale

- Familiarity with payment-specific environments - CDE monitoring, SWIFT, PCI DSS context

- Purple teaming experience working alongside an offensive security team

**Benefits**

- 30+ days off

- Unlimited sick leave

- Free office meals

- Health coverage

- Apple gear to keep you productive

- Courses, conferences, sports and wellness benefits

## Skills

### Required
- SIEM
- MITRE ATT&CK
- KQL
- SPL
- AWS
- Google Workspace
- Python
- scripting
- automation
- threat intelligence

### Nice to have
- SOAR
- UEBA
- threat intelligence enrichment
- alert contextualization
- payment-specific environments
- CDE monitoring
- SWIFT
- PCI DSS
- purple teaming

---

Source: [Apply at jobs.ashbyhq.com](https://jobs.ashbyhq.com/solidgate/7a0b504d-8bb2-4427-b516-ad80eb8d2a70?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)