SOC Engineer

ppIt all starts with the mission: NVISO is here to protect European society from potentially devastating cyber attacks This means

we offer
cyber security services to private and governmental organizations to help them better prepare for, prevent, detect and respond to cyber security incidents. /p pAll of this is built on four fundamental values that define who we are: We are Proud, We Break Barriers, We Care and No BS /p h3What will you do? /h3 pbWhat will you do? /b /p pAs a Senior SOC Engineering Consultant, based in bGreece /b, you will help build, operate and scale the technical backbone of NVISO’s Managed Security Services (MSS). You engineer the platforms, integrations and detection infrastructure that our 24×7 Managed Detection Response service is delivered on, across Microsoft Sentinel, Elastic Cloud, Microsoft Defender XDR, Cortex XDR, SentinelOne, cloud platforms and ISC/OT sensors. /p pYou understand that a modern SOC is only as strong as the telemetry it sees and the platforms it runs on. Your work makes sure that customer log sources are cleanly onboarded, that log forwarding infrastructure is fit for purpose, that detection content is deployed and tested, and that our analysts get high-signal alerts with the context they need to act. As a senior member of the team, you go beyond individual integrations – you shape reusable engineering patterns, mentor more junior colleagues and act as a technical point of reference in engagements with customers. /p pYou support customers and colleagues by translating operational SOC needs into sustainable engineering strategies and practical implementations, covering log onboarding, parsing and normalization, forwarder deployments, SIEM/EDR platform configuration, automation and lifecycle management. You have strong communication and interpersonal skills, which enable you not only to understand requirements, but also to put these requirements into an implementation roadmap, explain it to customers and guarantee proper execution. You have an open and approachable mind, in line with NVISO’s values. /p pTypical tasks include but are not limited to: /p ul liOnboarding new customer log sources into NVISO’s SIEM platforms (Microsoft Sentinel, Elastic Cloud), preferring native connectors and falling back to customer-hosted, NVISO-managed log forwarders where required;br/ /li liDesigning, deploying and maintaining log forwarding infrastructure – including load-balanced forwarder clusters – that sits in the customer environment and is operated by NVISO;br/ /li liBuilding and maintaining parsers, normalization and enrichment logic so that data lands in the SIEM in a format detection engineering can rely on;br/ /li liConfiguring and integrating EDR/XDR platforms (Microsoft Defender for Endpoint, Cortex XDR, SentinelOne, Microsoft Defender XDR) and cloud platform monitoring (Azure, AWS) into the MSS delivery stack; /li liSupporting the detection engineering team with the platform-side of rule deployment and testing across supported SIEM and EDR/XDR ecosystems;br/ /li liBuilding automations and integrations on our SOAR platform (XSOAR) and contributing to Core platform (Azure Functions, Durable Task Scheduler, Application Insights, Log Analytics, Bicep-based IaC) that supports our service delivery;br/ /li liContributing to the evolution of our Self-Service Onboarding capability and service in generalbr/ /li liDefining high-level engineering patterns and reusable building blocks rather than only point solutions for individual customers;br/ /li liParticipating in technical workshops with customers, detection engineers and senior SOC analysts to capture requirements and translate them into implementation plans;br/ /li liActing as a technical point of reference for junior colleagues, sharing patterns and coaching them on the specifics of MSS engineering; /li /ul h3Requirements /h3 pbTechnical

Skills:
/b /p ul liHands-on experience with at least one major SIEM platform (Microsoft Sentinel, Elastic, Splunk, or similar), including log source onboarding, parsing/normalization and rule deployment; /li liA solid understanding of SOC operations, incident response workflows and the difference between detection engineering, SOC engineering and SOC analysis; /li liWorking knowledge of log forwarding technologies and centralized collector patterns (e.g. Logstash, Elastic Agent, syslog collectors, cloud-native connectors) /li liA strong foundation in Python and/or other relevant scripting or automation languages, and comfort with APIs /li liPractical experience with at least one EDR/XDR ecosystem (Microsoft Defender for Endpoint / Defender XDR, Cortex XDR, SentinelOne) or a desire to specialize in one /li liFamiliarity with cloud platforms (Azure and/or AWS) from a security telemetry perspective — audit logs, activity data, identity signals, cloud-native detection tooling; /li liThe ability to think beyond individual integrations and contribute to scalable engineering patterns, reusab