Senior Security Operations Engineer

The opportunity

What you’ll do

• Lead complex security investigations from initial alert validation through scoping, containment recommendations, eradication, recovery validation, documentation, and lessons learned.
• Serve as a senior escalation point for Client Sentinel, Client Defender XDR, endpoint, identity, email, cloud, SaaS, and network security alerts.
• Coordinate with Scout’s managed detection and response provider to ensure 24/7 monitoring, high-quality triage, timely escalation, complete case documentation, and effective handoff to internal responders.
• Participate in the Security Operations on-call rotation and respond to high-priority events outside normal business hours, including nights, weekends, and holidays.
• Develop, tune, test, and maintain analytics rules, hunting queries, workbooks, watchlists, automation rules, and investigation content using Kusto Query Language (KQL).
• Build and improve SOAR and workflow automation that enriches incidents, reduces repetitive analyst work, accelerates containment, and maintains appropriate human oversight for high-impact actions.
• Perform threat hunting across endpoint, identity, email, cloud, network, and application telemetry using current threat intelligence, indicators of compromise, attacker behaviors, and incident trends.
• Administer and optimize core security operations capabilities, including Client Sentinel, Client Defender XDR, Client Defender for Endpoint, Defender for Office 365, Defender for Identity, Client Entra ID security signals, and related integrations.
• Investigate and coordinate response across complementary platforms such as Zscaler, Abnormal Security, Wiz, PagerDuty, Jira, Fresh service, and Scout’s managed security services.
• Create and maintain incident response playbooks, investigation procedures, escalation paths, evidence-handling guidance, threat-hunting content, and operational runbooks in Confluence.
• Collect, preserve, and analyze digital evidence when required; support endpoint and cloud forensic activities while maintaining clear documentation and chain-of-custody practices.
• Partner with IT Operations, IAM, Cloud and Platform Engineering, DevSec-Ops, GRC, Legal, Privacy, HR, Physical Security, Communications, business owners, and external responders during incidents and security improvement initiatives.
• Support high-profile and zero-day vulnerability response by assessing exposure, hunting for exploitation, coordinating remediation owners, tracking risk, and communicating status.
• Help operationalize exposure and cloud-security findings by correlating Wiz and other vulnerability data with asset context, active threats, and business impact.
• Produce clear incident updates, post-incident reports, operational metrics, and leadership-ready summaries that explain risk, impact, decisions, and recommended actions.
• Mentor analysts and partner teams, lead knowledge-sharing sessions, and raise the overall technical quality and consistency of Security Operations.
• Identify recurring failure patterns and convert lessons learned into improved detections, controls, playbooks, automation, logging, and response readiness.
• Participate in tabletop exercises, purple-team activities, detection validation, and other readiness exercises relevant to enterprise, cloud, manufacturing, supplier, and automotive environments.

What you’ll bring

• Bachelor’s degree in cybersecurity, computer science, information systems, engineering, or related field, or equivalent professional experience.
• 5+ years of progressive experience in security operations, incident response, threat detection, digital forensics, security engineering, or a closely related discipline.
• Demonstrated ability to lead complex technical investigations and make sound decisions with incomplete or rapidly changing information.
• Hands-on experience with a modern SIEM and EDR/XDR platform. Strong Client Sentinel and Client Defender experience is preferred.
• Proficiency with KQL or a comparable security-query language, including log correlation, detection development, threat hunting, troubleshooting, and dashboard creation.
• Experience investigating identity, endpoint, email, cloud, SaaS, and network threats, including account compromise, phishing and social engineering, malware, ransomware, insider risk, data loss, and third-party compromise.
• Working knowledge of Client Entra ID, Client 365 security, Azure, and AWS security concepts and telemetry.
• Experience with incident management, case management, and collaboration platforms such as PagerDuty, Jira, Fresh service, Teams, and Confluence.
• Understanding security automation and orchestration, APIs, scripting, and repeatable workflow design. PowerShell, Python, JSON, or Logic Apps experience is valuable.
• Knowledge of vulnerability and exposure management, cloud security posture management, risk-based prioritization, and remediation coordination.
• Familiarity with forensic collection and analysis, evidence preservation, timeline reconstruction, and clear investigative reporting.
• Ability to communicate technical findings to engineers, business owners, legal and privacy partners, and senior leadership without overstating certainty.
• Strong documentation habits, attention to detail, and a bias toward repeatable, auditable processes.
• Ability and willingness to work in person in Charlotte, North Carolina and participate in a rotating on-call schedule that includes nights, weekends, and holidays.
• Experience in implementing agentic capabilities within the SOC environment.

Preferred qualifications

• Experience operating security capabilities in a high-growth, automotive, manufacturing, engineering, or technology organization.
• Experience working with an MDR/MXDR or MSSP and improving provider performance, escalation quality, and operational integration.
• Hands-on experience with Zscaler, Abnormal Security, Wiz, cloud workload protection, DLP, threat intelligence, or malware-analysis platforms.
• Experience building or tuning SOAR playbooks, Logic Apps, API integrations, and AI-assisted investigation workflows.
• Experience supporting tabletop exercises, major incidents, crisis-response bridges, and post-incident improvement programs.
• Relevant certifications such as CISSP, GCIH, GCIA, GCFA, GNFA, SC-200, AZ-500, Security+, or equivalent demonstrated expertise.

Location and travel expectations

On-call and incident-response expectations

How success will be measured

• Consistent, high-quality investigation and escalation of security incidents.
• Improved detection fidelity, logging coverage, automation, and response speed.
• Clear case documentation, incident communications, and post-incident follow-through.
• Effective partnership with the MDR provider and Scout technical teams.
• Measurable reductions in recurring alert noise, investigation friction, and operational gaps.
• Practical improvements to playbooks, detections, dashboards, integrations, and team readiness.

Scout values in action