SOC Detection Engineer

SOC Detection Engineer | Guararema, Brazil

Support the Cybersecurity Operations SIEM Detection Engineering capability across teams and business segments. This role is a deep technical subject matter expert who creates, tests, deploys and continuously improves SIEM detections to increase the efficiency and accuracy of incident detection and response. The role tunes existing detections to reduce unnecessary alerts, identifies gaps in detection coverage, validates telemetry for detection use cases and automates detection and investigation steps.

What will be your key responsibilities?

• Create, deploy and maintain SIEM detection rules aligned with MITRE ATT&CK.
• Validate detections through testing and attack simulation before and after deployment.
• Review and tune existing detections using performance metrics to improve true positive rates, reduce false positives and retire noisy or low-value rules.
• Identify gaps in detection coverage across business segments and prioritize new use cases based on threat relevance and risk.
• Ensure security telemetry is complete, accurate and suitable for detection use cases.
• Automate detection, enrichment and investigation steps to reduce manual analyst effort and speed up response.
• Work with SOC operations, incident response, threat intelligence and SOAR teams to turn threat insights and incident lessons learned into actionable detections.
• Support integrations between SIEM, case management and enrichment platforms, working with the SOAR team, so that alerts carry the right context for triage.
• Maintain clear documentation of detection logic, tuning decisions and coverage mapping, and share knowledge with SOC stakeholders.

What are we looking for?

• 3+ years of work experience in cybersecurity or related information technology areas
• Previous hands-on SOC analyst experience, with a practical understanding of alert triage, investigation workflows and how detection quality affects operations
• Intermediate to advanced experience with SIEM platforms and security query languages
• Experience developing detection use cases, correlating data and mapping detections to attack lifecycle frameworks (e.g., MITRE ATT&CK)
• Knowledge of common security log sources (e.g., EDR, Windows events, identity, cloud and network telemetry)
• Solid data analytics skills, including analyzing large datasets to find patterns, anomalies and tuning opportunities
• Scripting experience (e.g., Python, PowerShell, Bash) and a good grasp of programming logic
• Understanding of offensive security and attacker techniques
• Strong technical writing and communication skills

Nice to have:

• Experience with detection-as-code and version control (e.g., Git)
• Relevant cybersecurity certifications (e.g., SIEM, detection engineering or incident response)
• Understanding of SOAR and security automation concepts
  

What can you expect from Mars?

• Work with diverse and talented Associates, all guided by the Five Principles.
• Join a purpose driven company, where we’re striving to build the world we want tomorrow, today.
• A strong focus on learning and development support from day one, including access to our in-house Mars University.
• An industry competitive salary and benefits package, including company bonus.

#LI-Onsite
#TBdigital