Information Security Engineer (SOC L2)

About the role

Tabby is looking for an Information Security Engineer (SOC L2) to protect its infrastructure, applications, and cloud environments. You will lead incident response, develop detection rules, and work closely with cross‑functional teams to improve the company’s security posture.

Key responsibilities

• Monitor and analyze logs and alerts from firewalls, IDS/IPS, endpoints, servers, and cloud platforms.
• Correlate events across multiple sources to identify advanced threats and unusual behavior.
• Fine‑tune alert thresholds and detection logic to reduce false positives.
• Maintain real‑time dashboards and reporting on security posture.
• Serve as a frontline responder for security incidents, handling detection, containment, eradication, recovery, and lessons learned.
• Coordinate with internal stakeholders and external vendors during high‑severity incidents or data breaches.
• Perform root‑cause analysis and forensic investigations using endpoint and network artifacts.
• Research emerging threats and contribute to detection rule development, threat‑hunting queries, and use cases across cloud environments.
• Maintain and integrate CTI feeds with security controls for active threat‑driven detections.
• Communicate clearly with IT, DevOps, Risk, and Compliance teams during incidents and investigations.

Required profile

• Proven experience monitoring logs and alerts from firewalls, IDS/IPS, endpoints, servers, and cloud platforms.
• Hands‑on experience developing and tuning security detection rules.
• Familiarity with threat intelligence platforms and integrating CTI feeds.
• Ability to conduct forensic investigations and root‑cause analysis.

Required skills

• Firewalls
• IDS/IPS
• Endpoint detection and response
• Servers
• Cloud platforms
• Log analysis
• Threat intelligence platforms
• Security incident response
• Forensic investigation