Sr. SOC Engineer

Zimperium® is the world leader in mobile security, purpose-built to protect the modern mobile enterprise. Trusted by leading organizations and governments, our AI-driven platform delivers real-time, on-device protection for mobile applications and devices. We help organizations stay ahead with proactive defense against evolving threats—including mobile-targeted phishing (mishing), malware, app vulnerabilities, and zero-day exploits. Our mission is to empower organizations to operate securely and confidently in today’s dynamic digital environment.

We are looking for a Sr. SOC Engineer to own and operate our Google Sec Ops platform end-to-end. You will architect log ingestion, author threat detection rules, design agentic AI-powered triage and response automation, integrate our CNAPP platform with security operations workflows, and lead investigative response to high-severity incidents. This is a hands-on engineering role: you will execute the work yourself, not manage others' execution.

You will own the detection strategy, platform architecture, automation design, and incident response quality. You will be the person your team calls when a new log source needs to be ingested and routed, when detection rules aren't firing, or when a complex incident demands technical leadership.

You will own the outcomes and drive how the SOC operates. You will work in close collaboration with our Dev Ops, Cloud Security, and Product Security teams. You are expected to operate independently, make architectural decisions, and have the judgment to act without direction. Your technical and strategic decisions will drive Zimperium's security posture directly.

Location:
Dallas, TX preferred

• 8+ years in security operations, threat detection, or incident response, with at least 4 years in a SIEM/SOC engineering or detection engineering role.

• Deep hands-on experience with at least one major SIEM platform (Splunk, ELK, Chronicle/Google Sec Ops, Sentinel, Sumo Logic). Production experience with detection authoring and tuning.

• Strong understanding of log types and sources—OS logs, application logs, network flow, DNS, proxy, endpoint telemetry, CNAPP/runtime security events. Ability to interpret and normalize heterogeneous data.

• Experience building or tuning threat detection rules and correlation logic. Working knowledge of attack frameworks (MITRE ATT&CK) and how to operationalize them.

• Proficiency in at least one scripting/programming language (Python, Go, Bash) sufficient to build and maintain automation, not just modify examples.

• Experience integrating security tools—APIs, webhooks, orchestration platforms (Zapier, Make, native SOAR). Comfortable debugging API calls and data flow.

• Hands-on incident investigation experience—evidence collection, root cause analysis, timeline reconstruction, scope determination.

• Familiarity with mobile threat detection, CNAPP, or endpoint threat detection. Understanding of how mobile/app security signals differ from infrastructure security.

• Strong written and verbal communication—ability to explain technical findings to non-technical stakeholders and brief executives on incidents and trends.

• Proven ability to operate independently, take ownership, and make decisions with sound judgment to non-technical stakeholders and brief executives on incidents and trends.

• Proven ability to operate independently, take ownership, and make decisions with sound judgment.

• Strong written and verbal communication—ability to explain technical findings to non-technical stakeholders and brief executives on incidents and trends.

• CNAPP & Sec Ops Integration. Orchestrate data flow from Zimperium's CNAPP platform into Google Sec Ops and other security tools. Build and own…