Information Security Engineer – SOC L2

About the role

As an Information Security Engineer you will monitor and defend Tabby’s infrastructure, applications and cloud environments from cyber threats. You will lead incident response, develop detection rules and work closely with cross‑functional teams to continuously improve the security posture.

Key responsibilities

• Monitor and analyze logs and alerts from firewalls, IDS/IPS, endpoints, servers and cloud platforms.
• Correlate events across multiple sources to identify advanced threats and reduce false positives.
• Maintain dashboards and real‑time reporting on security posture.
• Act as the frontline responder for security incidents, managing detection, containment, eradication and recovery.
• Coordinate with internal stakeholders and external vendors during high‑severity incidents or data breaches.
• Perform root‑cause analysis, forensic investigations and produce detailed incident documentation.
• Research emerging threats and contribute to detection rule creation, threat‑hunting queries and use‑case development.
• Integrate CTI feeds with security controls to enable active threat‑driven detections.
• Communicate incident updates to stakeholders and mentor junior SOC analysts.

Required profile

• 2–3 years of experience in a SOC or cybersecurity operations role, preferably in a fast‑paced fintech environment.
• Strong knowledge of incident handling, alert triage, log analysis and threat modeling.
• Understanding of online technologies, REST APIs, microservices and modern application architectures.
• Security certifications such as Security+, CySA+, eCIR, eCTHPv2, GCIA or GMON are a plus.
• Excellent communication skills for coordinating response and writing clear incident reports.

Required skills

• SIEM platforms (e.g., Splunk, QRadar)
• SOAR tools
• EDR/XDR solutions
• Threat Intelligence platforms and CTI feed integration
• Cloud‑native logging and monitoring tools (AWS, Azure, GCP)
• Python scripting for automation
• DLP, AV and anti‑malware systems
• Phishing detection and user‑behavior analytics
• Experience with IDS/IPS and firewall log analysis