At Solidgate, our mission is clear: to empower outstanding entrepreneurs to build exceptional internet companies.

We exist to fuel the builders , the ones shaping the digital economy , with the financial infrastructure they deserve.

You will define what detection looks like at Solidgate: what gets monitored, what gets detected, and how the team responds when something goes wrong.

Responsibilities

Build and operationalize the SIEM from PoC to production - including case management and UEBA, with full ownership of the technology selection
Design, write, and tune detection rules mapped to MITRE ATT&CK, covering identity compromise, privilege escalation, lateral movement, and endpoint threats
Triage and investigate L2/L3 alerts, reduce false positives, and establish clear escalation paths for each use case
Lead incident response and basic forensics - containment, eradication, and structured lessons learned
Onboard log sources across AWS, JumpCloud, Google Workspace, CDE, and SWIFT;
Run threat hunts based on realistic attack hypotheses specific to a payment platform's risk profile
Build and maintain runbooks and playbooks; automate repetitive actions via SOAR or scripting
Define SOC metrics and own monthly reporting to management on detection coverage and response performance

Requirements

3+ years in SOC / Detection & Response at L2/L3 level, with hands-on investigation experience
Practical experience building or operating a SIEM, including writing and tuning detection rules
Detection engineering with MITRE ATT&CK mapping; confident with KQL, SPL, or equivalent query languages
Experience investigating cloud log sources: AWS CloudTrail, GuardDuty, Google Workspace, EDR/XDR
Scripting and automation skills (Python or similar) for telemetry processing and routine tasks
Solid understanding of attacker techniques and how they manifest in logs - not just tool knowledge, but threat understanding
Structured under pressure: disciplined investigation process, clear documentation, clean post-mortems

Nice to Have

SOAR experience and a detection-as-code approach (version control for rules, CI pipelines for detection)
UEBA, threat intelligence enrichment, or alert contextualization at scale
Familiarity with payment-specific environments - CDE monitoring, SWIFT, PCI DSS context
Purple teaming experience working alongside an offensive security team

Benefits

SOC L2/L3 Engineer

Skills