Cyber SOC Engineer III

JOB SUMMARY: The IS Cyber SOC Engineer III is a highly skilled senior role responsible for the design, deployment, and optimization of our security detection and response infrastructure in support of a 24/7 SOC to support its operational efficiency. This role will ensure the defensive stack, including SIEM, SOAR, EDR, NDR, and DLP, is functioning at peak performance across a hybrid environment consisting of cloud workloads and on-premises locations.

This role focuses on ensuring the organization’s detection stack is automated, scalable, and resilient against modern adversaries. This position will work closely with the Security Platform Operations Team, Cloud Security Engineering, Network Engineering, and Cloud and Enterprise Architecture Teams to maintain the efficiency and effectiveness of the SOC’s tools and environment and serve as a liaison during product evaluations, implementations, and technology refresh projects.

This position is responsible for representing the needs of the SOC to ensure effective operational continuity and serves as the escalation contact for product support. Additionally, the role provides direct assistance to the SOC during security incidents. This position plays a vital role in establishing and maintaining a corporate-wide information security engineering and architecture program to ensure information assets are adequately protected and that a framework is implemented which upholds current standard operating procedures for technology platforms and processes.

Additionally, this position provides leadership in the definition, implementation, evaluation, and maintenance of controls to protect systems and applications in accordance with security requirements. The SOC Engineer III holds key responsibility for providing feedback to the Security Operations Center (SOC) Manager regarding the security architecture framework to ensure systems lifecycle activities remain secure through development, acquisition, certification, and accreditation processes for all information assets.

The position requires staying current on security threats, trends, and technologies while managing and supporting existing security solutions, evaluating, designing, and implementing new security controls, and helping the organization meet security objectives.

• Subject matter expert in their field, driving resource allocations, accountability for deliverables, and exception management documentation.
• Monitor and assist in maintaining a hybrid visibility architecture.
• Support SOC monitoring personnel in building and optimizing detection logic for threat hunting and SOAR playbooks to automate repetitive tasks.
• Oversee the health and tuning of SOC tools.
• Serve as a technical leader and escalation point for SOC tool failures and provide product SME support during incident investigations.
• Participate in writing and implementing security policies, standards, and procedures; continuously improve the effectiveness of the corporate security program.
• Participate in on-call and shift work supporting SOC operations, including incident response.
• Monitor regulatory and legislative changes impacting the protection of regulated data (SOX, GLBA, etc.).
• Govern security metrics demonstrating security program effectiveness, reduced incidents, positive audit outcomes, and program cost reductions.
• Support research and development of mitigation strategies against emerging threats.
• Lead technical and non-technical projects, including tracking, issue management, and follow-up.
• Provide short-, medium-, and long-term analysis of internal and external threat, protection, and response data.
• Monitor and validate implementation of security practices required to comply with GLBA, PCI-DSS, HIPAA, SOX, and other regulations.
• Provide leadership support in planning, designing, and evaluating privacy and security-related projects.
• Adhere to all applicable federal and state laws and regulations, including anti-money laundering requirements (Bank Secrecy Act, USA PATRIOT Act, etc.).
• Adhere to Bank policies and procedures and complete required training.
• Identify and report suspicious activity.