Skillhouse Internal Career Opportunity
Security Operations Engineer (SOC / Detection & Automation) (8416)
Position Title:
Security Operations Engineer (SOC / Detection & Automation) (8416)
Employment Type:
Haken
Working Hours:
English Level - Advanced (TOEIC 860), Japanese Level - None
Salary
Description
A Global IT Service firm is seeking a Security Operations Engineer (SOC / Detection & Automation) to support the full System Development Life Cycle (SDLC) and operation security for the services developed inside the Group, with dedicated security teams and operation centers in key regions worldwide.
The team monitors and investigates production alerts, builds detections and automation, and responds to incidents, working closely with product and platform development teams.
Responsibilities:
- Alert monitoring: Monitor and triage alerts from production sources such as server and host logs, EDR and runtime security agents on servers and containers, container and Kubernetes audit logs, network intrusion detection, web application firewall and DNS logs, and vulnerability or posture findings
- Threat analysis: Separate genuine threats from false positives, including suspicious process and command execution, privilege escalation, unusual outbound connections, exploitation of public-facing services, and container or Kubernetes abuse
- Incident response: Take part in investigation, containment, and recovery for production incidents. Escalate within the team for incident management coordination, and to platform or application teams where root cause needs their involvement
- Incident documentation: Document incidents, triage findings, and escalation rationale clearly and accurately, so handoffs are clean
- Proactive threat hunting: Analyse logs, traffic patterns, and system telemetry to find sophisticated threats that bypass signature-based defences
- Alert tuning: Identify false positive patterns across alert volume and propose changes to SIEM detection queries, following the team's approval workflow rather than editing production rules directly
- Detection development: Develop, tune, and maintain high-fidelity detection rules across SIEM, EDR, and other security tools. Suggest new rules and analysis approaches based on observed gaps, and map detections to MITRE ATT&CK
- Correlation and enrichment: Combine data sources (for example network, web, DNS, and host telemetry) to enrich alerts and reduce investigation time
- Response automation: Design and implement automated workflows (SOAR) and scripts that respond to common threats and reduce manual work for the team
- Custom tooling: Build internal tools and scripts that close gaps in the security stack and improve visibility across the production environment
- CI/CD guardrails: Partner with SRE and DevOps teams to integrate automated security guardrails into CI/CD pipelines
Required Skills:
- 4+ years in a cyber security role (security operations, incident response, detection engineering, or security engineering) monitoring production environments
- Experience working with alerts or detections from a SIEM and from EDR, host, or network security tools
- Solid understanding of network protocols, OS internals (Linux and Windows), and web application architectures
- Working knowledge of containers and container orchestration (for example Kubernetes) sufficient to put audit log events in context, such as pods, namespaces, RBAC, and service accounts, without requiring engineering experience
- Familiarity with MITRE ATT&CK and how to map real-world activity to its tactics
- Comfortable working a shift or follow-the-sun rota and, where required, on-call responsibilities
- Strong analytical and problem-solving skills, and the ability to explain findings clearly to technical and non-technical stakeholders in a cross-functional team
- Plus depth in at least one focus area: 1) Security operations focus or 2) Detection engineering and automation focus
Why should you apply:
- Contribute to strategic initiatives in the rapidly growing fields of AI and technology
- Gain broad experience through projects spanning diverse technology and business areas
- Work with global teams and stakeholders, leveraging both Japanese and English
Company Overview
A leading global technology and telecommunications company with operations worldwide. The company offers a diverse range of digital and technology-related businesses and continues to expand its global service ecosystem through ongoing investment in AI and digital transformation.
Working Hours: 9:00–17:30
Work Style : Hybrid
Holidays: Saturdays, Sundays, public holidays, and paid annual leave
Benefits: Standard social insurance and employee benefits package
