Security Operations Engineer

ABOUT

THE ROLE "You'll build the detections that catch what alerts alone would miss, and the automation that keeps a lean team ahead of the threats."As a Security Operations Engineer on Mastery's Information Security team, you'll own detection engineering and SOAR automation for Master Mind, our Azure-native transportation management platform. You'll design and tune the analytics rules running in Microsoft Sentinel, build automated response workflows that cut manual triage time, and close visibility gaps across our AKS, endpoint, and network telemetry as we bring new log sources online.

This role is ideal for a deeply technical engineer who wants to build and ship detections and automation — not manage people or run the team's day-to-day. If you'd rather spend the day in KQL and automation workflows than in a status meeting, this is built for you.

WHAT YOU'LL OWN Detection Engineering Build real detections: design, write, and tune analytics rules and correlation logic in Microsoft Sentinel, aligned to MITRE ATT&CK.Close the gaps: identify and close visibility blind spots across our infrastructure and telemetry as new log sources come online.

Reduce the noise: continuously validate and refine detections to cut false positives without losing real signal.

Automation & Response Automate the busywork: design and build SOAR playbooks and workflows that automate triage, enrichment, and response, freeing the analyst team to focus on real investigations.

Integrate the stack: build and maintain integrations across Sentinel, Defender, and other security tooling via APIs and scripting.

Technical Depth & Threat Context Translate intel into detections: turn emerging threats and adversary TTPs into actionable, tuned detection logic.

Stay hands-on: keep pace with evolving attacker techniques and Sentinel/SOAR platform capabilities through direct, ongoing technical work.

WHAT YOU BRINGExperience4+ years in security operations, detection engineering, or a closely related technical security role.

Demonstrated, hands-on experience building or substantially tuning detection rules and correlation logic in a SIEM (Sentinel strongly preferred).Experience building SOAR playbooks or comparable security automation workflows.

Skills & Approach Deep query language fluency: comfortable writing and debugging complex KQL (or equivalent SIEM query language) without hand-holding.

Scripting and API proficiency:
Python or Power Shell for automation, with experience integrating tools via REST APIs.Self-directed technical focus: prefers to own and ship technical work independently over managing people or processes.

Nice to Have Experience in an Azure/AKS or other Kubernetes-based cloud environment.

Experience supporting SOC 2 or similar compliance audits from a technical evidence standpoint.

Familiarity with Sentinel Logic Apps or another SOAR automation platform.

HOW YOU'LL KNOW YOU'RE SUCCEEDING Detection coverage measurably improves: new log sources come online with real, tuned detections behind them, not just raw ingestion.

False positive rates drop: the analyst team trusts what fires in the queue instead of triaging noise.

Manual triage time shrinks: SOAR playbooks handle the repeatable work so the team's time goes to real investigations.

ABOUT MASTERY Most TMS platforms are tolerated. We've proven a better way — one platform built for every facet of transportation: shippers, carriers, private fleets, and brokers, all under one roof. Built to be loved. We're still the only ones who mean that.

Mastery Logistics Systems exists because the transportation industry deserves better. For too long, shippers and carriers have been forced to stitch together a patchwork of outdated, inadequate systems — one for dedicated fleet, another for…