Senior SOC Engineer

About the role

Syntegon Telstar S.R.U, part of the Syntegon Group, is looking for a hands-on Senior SOC Engineer to join its team in Terrassa (Barcelona). You will help design, build and continuously improve the technology behind the Security Operations Center, owning the engineering backlog across SIEM, SOAR, EDR/XDR and log pipelines. Working closely with the SOC Leader and analyst teams, you act as a technical escalation point for complex incidents and help strengthen the SOC through automation, process improvement and reliable engineering solutions.

Key responsibilities

• Design, develop and maintain detection content across SIEM, EDR/XDR and NDR platforms, aligned to MITRE ATT&CK TTPs, from requirements through tuning and deprecation.
• Build and optimise SOAR playbooks and automated response workflows across triage, enrichment, containment and evidence collection.
• Own the onboarding of new log sources and manage data ingestion pipelines for cost-effectiveness, completeness and reliability.
• Act as Tier 3 technical escalation for complex investigations and high-severity incidents, supporting forensic analysis, malware triage and root cause determination.
• Maintain the health, performance and reliability of core SOC platforms and evaluate new tooling aligned to the SOC's maturity roadmap.
• Partner with IT, Cloud, Network and Identity teams to improve log coverage and response integration, and mentor Tier 1-2 analysts on detection logic and tooling.
• Ensure detection and engineering controls support compliance requirements and keep audit-ready documentation.

Required profile

• 5-8+ years in cybersecurity, with 3+ years in a SOC engineering, detection engineering or senior analyst role.
• Deep hands-on expertise with SIEM platforms, including query authoring and detection rule development.
• Proven experience building SOAR playbooks and automating security workflows.
• Strong knowledge of attacker TTPs and the MITRE ATT&CK framework, able to turn them into detection logic.
• Experience with log onboarding, data normalisation and pipeline management at scale.
• Clear written and verbal communication, able to document technical content for varied audiences.

Required skills

• SIEM, EDR/XDR, NDR and cloud telemetry
• Scripting or development skills such as Python, PowerShell or KQL
• Preferred: GIAC (GCIA, GCED, GCIH, GCFA, GMON), Microsoft SC-200 or equivalent cloud security certifications
• Preferred: threat hunting, offensive security/red teaming, OT/ICS security, data privacy and eDiscovery

Applications should be submitted in English. Travel of approximately 10-20% is required when needed (HQ in Germany).