Information Security Engineer – SOC L2

About the role

Tabby is looking for an Information Security Engineer to join its SOC L2 team. You will monitor, detect, and respond to cyber threats across the company’s infrastructure, applications, and cloud environments, helping to protect millions of users and partner brands.

Key responsibilities

• Monitor and analyze logs and alerts from firewalls, IDS/IPS, endpoints, servers, and cloud platforms.
• Correlate events from multiple sources to identify advanced threats and reduce false positives.
• Maintain dashboards and real‑time reporting on security posture.
• Lead incident response from detection through containment, eradication, recovery, and lessons learned.
• Conduct root‑cause analysis, forensic investigations, and produce detailed incident documentation.
• Research emerging threats and develop detection rules, threat‑hunting queries, and use cases.
• Integrate CTI feeds with security controls to enable active threat‑driven detections.
• Collaborate with IT, DevOps, Risk, and Compliance teams and mentor junior analysts.

Required profile

• 2–3 years of experience in a SOC or cybersecurity operations role, preferably in a fast‑paced fintech environment.
• Strong knowledge of security best practices, incident handling, alert triage, log analysis, and threat modeling.
• Understanding of online technologies such as REST APIs, microservices, and modern application architectures.
• Familiarity with DLP, AV, anti‑malware systems, phishing detection, and user‑behavior analytics.
• Experience working in a culturally diverse, collaborative setting.
• Security certifications (e.g., Security+, CySA+, eCIR) are a plus.

Required skills

• SIEM platforms and SOAR tools for security monitoring and automation.
• Endpoint Detection & Response (EDR/XDR) and forensic analysis capabilities.
• Threat Intelligence platforms and integration of CTI feeds.
• Cloud‑native logging and monitoring tools (AWS, Azure, GCP).
• Python scripting for task automation and SOC efficiency.
• Development and tuning of detection rules and threat‑hunting queries.