Senior Security Operations Engineer
Location: Remote (US-based)
About Dispel :
Dispel is the fastest-growing cybersecurity company recognized in the 2025 Cybersecurity Excellence Awards. We deliver zero trust secure remote access and real-time data streaming for operational technology (OT) and industrial control systems (ICS). Our patented Moving Target Defense technology — referenced in NIST 800-172 — protects critical infrastructure for utilities serving 54 million+ people, manufacturers producing over 50% of US baby formula, and major defense contracts including a $950M IDIQ with the US Air Force.
Why This Role Exists:
Dispel is pursuing FedRAMP High authorization while simultaneously operating a commercial security program. We have a functioning SOC built on Google SecOps (Chronicle) and SentinelOne, but we need a senior IC who can take it from "stood up" to "operationally mature." You'll own the log ingestion pipeline end-to-end and drive material expansion of coverage across federal and commercial environments, including AWS, Azure, and Entra ID.
This person will be the day-to-day technical owner of SOC operations, responsible for closing coverage gaps, building detections, maturing incident response, and providing senior technical direction to the existing SOC analyst. This is a hands-on-keyboard role with leadership expectations — you will not formally manage people, but you will set priorities, review deliverables, and drive execution across the SOC function.
Requirements
Key Responsibilities:
SIEM/SOAR Operations (Google SecOps)
- Own the log ingestion pipeline end-to-end: identify gaps, build feeds, validate parsing, maintain coverage dashboards
- Close the federal logging gap and stand up commercial logging across AWS, Azure, Entra ID, and SaaS
- Activate and configure SecOps SOAR capabilities including Domain-Wide Delegation, marketplace integrations, and bidirectional response actions
- Build and maintain SOAR playbooks for major incident types such as phishing, malware, account compromise, lateral movement, and cloud-specific threats
- Develop and maintain operational dashboards for SOC metrics, alert volumes, MTTA/MTTR, and coverage status
- Manage Google SecOps RBAC
Detection Engineering
- Build and deploy production detection rules mapped to MITRE ATT&CK within the first year
- Develop custom parsers for AWS-native security services including GuardDuty, Security Hub, Inspector, WAF, CloudTrail, and VPC Flow Logs
- Establish a detection lifecycle including proposal, testing, deployment, tuning, and retirement
- Conduct quarterly detection quality reviews to measure false positive rates, coverage gaps, and rule health
- Develop alert threshold optimization to reduce noise and analyst fatigue
Endpoint Detection and Response (SentinelOne)
- Drive SentinelOne deployment across Azure VMs in commercial environments and all federal endpoints
- Configure and operationalize Cloud Funnel for log export into Google SecOps
- Build correlation rules between EDR alerts and SIEM detections
- Manage SentinelOne RBAC groups and policy configuration
- Coordinate with IT on agent deployment, health monitoring, and version management
Incident Response
- Serve as senior escalation point for SOC incidents, ensuring investigations are thorough and reports include root cause, remediation actions, credential rotation plans, and follow-up timelines
- Improve MTTA and MTTR through process optimization, better tooling, and analyst development
- Lead quarterly tabletop exercises and after-action reviews
- Maintain and improve incident response runbooks for all major incident categories
- Integrate incident response workflows with Jira Service Management for tracking and escalation
Vulnerability Management
- Operationalize monthly scanning cadence across all environments using tools such as Nessus, AWS Inspector, and Azure Defender
- Define and enforce remediation SLAs by severity: Critical within 72 hours, Hi