The SOC Engineer leads customer onboarding for managed security services, integrating Microsoft security tools, SIEM platforms, cloud environments, identity systems, endpoints, networks, and SaaS sources. Responsibilities include validating telemetry, troubleshooting ingestion across Windows, Linux, cloud, and networking layers, building automation with scripts, supporting regulated and federal environments, documenting solutions, and resolving technical issues with customer stakeholders.
Job Title: SOC Engineer
Pay Type: SALARIED EXEMPT
Location: Remote (Must Work East Coast Hours)
Citizenship: U.S. Citizenship (Required)
Summary of Position Role/Responsibilities
Quzara is seeking a hands-on SOC Engineer to onboard customers into our managed security services and keep their security tooling and telemetry running reliably. The SOC Engineer works with customers and internal teams to integrate data sources, configure Microsoft security services, automate workflows, and resolve technical issues in federal and regulated environments.
Essential Functions of the Job
- Lead technical onboarding of new customers, from discovery and requirements through configuration, validation, and handoff.
- Configure and integrate Microsoft security services, including Microsoft Sentinel, Defender XDR, and Entra ID, with customer environments.
- Onboard and validate security telemetry from identity, endpoint, network, SaaS, and multi-cloud sources, including Azure, AWS, and Google Workspace.
- Integrate and troubleshoot log sources across multiple SIEM platforms, including Microsoft Sentinel, Splunk, SentinelOne, and IBM QRadar.
- Troubleshoot ingestion and integration issues across cloud, identity, network, Windows, and Linux layers.
- Build automation and scripts that make onboarding and operations repeatable.
- Support customers operating under federal and regulated requirements, including FedRAMP, CMMC, and NIST frameworks.
- Produce clear technical documentation and work directly with customer stakeholders to resolve onboarding blockers.
Marginal Functions of the Job
- Other duties as assigned
Normal Work Schedule:
This full-time role runs Monday to Friday, 8:30 AM–5:30 PM and requires flexibility to work remotely or on-site (if applicable per client RTO policies). On occasion additional hours may be necessary.
Education, Training, and Experience
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field preferred, or equivalent experience.
- 5+ years in IT infrastructure, cloud, or security engineering, including 3+ years hands-on with Microsoft Azure.
- 2+ years with Microsoft Sentinel or a comparable enterprise SIEM, including data-source onboarding.
- Strong working knowledge of the Microsoft security stack (Sentinel, Defender XDR, Entra ID, Azure Monitor / Log Analytics) and multi-tenant delegated access (Azure Lighthouse, GDAP).
- Hands-on experience onboarding a wide range of data sources (identity providers, endpoints, firewalls and network devices, SaaS applications, Syslog/CEF, API, and agent-based integrations) from Azure, AWS, and Google Workspace / Google Cloud.
- Experience working across multiple SIEM platforms, such as Microsoft Sentinel, Splunk, SentinelOne, IBM QRadar, or similar.
- Proficiency in KQL and scripting (PowerShell or Python), with solid troubleshooting skills across Windows, Linux, networking, and identity.
- Strong written and customer-facing communication skills.
- At least one current certification required: AZ-500 or SC-200.
- Preferred: prior MSSP, MDR, or security consulting experience; experience supporting federal or defense-industrial-base customers, including GCC and GCC High environments; and experience with EDR/XDR platforms such as CrowdStrike or SentinelOne.
Preferred Certifications
- Ideal: SC-100 (Microsoft Cybersecurity Architect Expert).
- Microsoft: AZ-104 (Azure Administrator), AZ-305 (Azure Solutions Architect Expert), SC-300 (Identity and Access Administrator), SC-401 (Information Security Administrator), MS-102 (Microsoft 365 Administrator).
- Cloud security: AWS Certified Security – Specialty, Google Professional Cloud Security Engineer.
- SIEM / EDR: Splunk Enterprise Security Certified Admin, IBM QRadar SIEM, SentinelOne, or CrowdStrike Falcon (CCFA) certifications, or equivalent.
- General security: CISSP, CCSP, CompTIA Security+ or CySA+, GIAC (GCDA, GCIH, or GCED).
EEO Statement
The Company is an Equal Employment Opportunity (EEO) employer and does not discriminate based on race, color, religion, sex, sexual orientation, national origin, age, marital status, disability, veteran's status, or any other basis protected by applicable discrimination laws.
Similar Jobs
Information Technology • Cybersecurity
Build and operate an agentic SOC investigation platform using LLMs, including telemetry tools, investigation workflows, evidence-backed outputs, evaluation systems, and analyst productivity features. Develop secure, reliable, observable backend services that handle attacker-influenced data across customer environments. Collaborate with SOC analysts, researchers, technical leads, and product managers to translate investigative expertise into production agent behavior.
Top Skills:
AWSAzureClaude CodeLlmsMicrosoft 365Mitre Att&CkPostgresRedisRubyRuby On Rails
Information Technology • Cybersecurity
Lead full-stack development for Huntress’s SOC platform, building analyst-facing investigation, triage, remediation, queueing, and customer reporting experiences. Shape architecture, data models, interfaces, security practices, reliability, observability, and testing while mentoring engineers and partnering with Product, UX, and SOC stakeholders. The role emphasizes Ruby on Rails, modern frontend development, cloud infrastructure, relational databases, and technical leadership across complex cybersecurity software products.
Top Skills:
AWSClaude CodeClickhouseCSSHotwireHTMLJavaScriptLinuxPostgresRubyRuby On RailsStimulusTurbo
Information Technology • Cybersecurity
Lead the architecture and development of a production Agentic SOC that uses LLM-based agents to investigate security signals, gather evidence, make defensible decisions, and support SOC analysts. Own agent behavior, tool use, evaluation, guardrails, tenant isolation, auditability, reliability, and autonomous decision-making. Collaborate with analysts, detection engineers, product, and engineering teams while providing technical leadership and mentoring. Build scalable backend systems using distributed workflows, queues, cloud infrastructure, and data stores.
Top Skills:
AWSAzureClaude CodeLlmsPostgresRedisRubyRuby On Rails
What you need to know about the Los Angeles Tech Scene
Los Angeles is a global leader in entertainment, so it’s no surprise that many of the biggest players in streaming, digital media and game development call the city home. But the city boasts plenty of non-entertainment innovation as well, with tech companies spanning verticals like AI, fintech, e-commerce and biotech. With major universities like Caltech, UCLA, USC and the nearby UC Irvine, the city has a steady supply of top-flight tech and engineering talent — not counting the graduates flocking to Los Angeles from across the world to enjoy its beaches, culture and year-round temperate climate.
Key Facts About Los Angeles Tech
- Number of Tech Workers: 375,800; 5.5% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Snap, Netflix, SpaceX, Disney, Google
- Key Industries: Artificial intelligence, adtech, media, software, game development
- Funding Landscape: $11.6 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Strong Ventures, Fifth Wall, Upfront Ventures, Mucker Capital, Kittyhawk Ventures
- Research Centers and Universities: California Institute of Technology, UCLA, University of Southern California, UC Irvine, Pepperdine, California Institute for Immunology and Immunotherapy, Center for Quantum Science and Engineering
