SOC Engineer
Happyrobot Inc.2 months ago
Barcelona, Spain or Madrid, SpainMid Level / Senior
Responsibilities
- Design, write, tune, and expand high-signal detections mapped to MITRE ATT&CK techniques while managing false-positive rates.
- Onboard, parse, normalize, and maintain cloud and identity log sources in the SIEM, with a goal of bringing tier-1 sources live within the first two quarters.
- Investigate alerts end-to-end, determine severity, document timelines and context, and drive alerts to clear disposition.
- Automate enrichment, response actions, and repetitive SOC tasks using Python or Go.
- Write and maintain triage runbooks for high- and critical-severity alert types.
- Establish the architecture, coverage, and processes needed to inform an in-house versus hybrid SOC decision by the end of September.
Requirements
- 3–5 years of experience in detection engineering, SOC engineering, or blue team roles.
- Hands-on experience building detections in a modern SIEM such as RunReveal, Panther, Elastic, Splunk, Sentinel, or similar.
- Deep familiarity with CloudTrail, GuardDuty, Kubernetes audit logs, and IdP/Okta logs.
- Proficiency scripting and automating with Python or Go.
- Experience mapping detections to MITRE ATT&CK.
- English proficiency at B2+ professional working level.
- Experience with detections-as-code managed in Git and deployed through CI/CD is preferred.
- EDR experience with SentinelOne or CrowdStrike is preferred.
- Incident response experience beyond triage is preferred.
- CNAPP exposure, such as Wiz, and cloud security fundamentals are preferred.
- GCIA, GCDA, GCIH, or BTL2 certification is preferred.
- Prior experience building monitoring from scratch at a SaaS or technology startup is preferred.
Benefits
- Healthcare, dental, and vision coverage.
- Competitive salary plus equity.
- High-growth AI startup environment with ownership and autonomy.
Tech Stack
Categories
About Happyrobot Inc.
Happyrobot Inc. builds an enterprise platform for deploying and orchestrating autonomous AI agents that communicate over voice, email, and other channels, take actions, and integrate with core systems. It sells to large operations teams in logistics, utilities, and other industries, with customers including DHL and Naturgy. Founded in 2023 and headquartered in San Francisco, the privately held company is a Y Combinator (S23) alum backed by investors such as a16z and Base10.