Senior Information Security Engineer - MSSP SecOps

About the role

Lumen is hiring a Security Platform & SecOps Engineer to design, build, automate, operate and continuously improve the security platforms behind Managed Security Services Provider (MSSP) Security Operations Centre services. This is a senior hands-on engineering role with end-to-end ownership of platforms covering SIEM, XDR, SOAR, security data pipelines, threat intelligence, cloud security, identity protection, exposure management and SecOps automation, delivering scalable, automated, resilient and measurable 24x7 SOC services.

Key responsibilities

• Design and implement MSSP-grade security platform architectures and unified SecOps capabilities across SIEM, XDR, SOAR, EDR, NDR, cloud security, identity security, threat intelligence, ITSM, vulnerability and exposure management.
• Build and maintain telemetry ingestion using agents, collectors, syslog, CEF/LEEF, APIs, event hubs, forwarders, cloud connectors and OpenTelemetry, and develop parsing, normalization, enrichment, routing, filtering, retention and data quality controls.
• Design SOAR playbooks and integrate platforms via REST APIs, webhooks, scripts, connectors, service principals and certificates, automating workflows such as phishing triage, suspicious sign-in response, IOC enrichment, endpoint containment and SLA tracking.
• Support detection engineering with SOC analysts and threat hunters, enable MITRE ATT&CK-aligned detections, Detection-as-Code practices and purple-team validation.
• Manage the lifecycle, patching and upgrades of SOC platforms, agents, collectors, connectors and integrations, including pre-upgrade assessments, rollback planning and post-upgrade validation.
• Lead technical onboarding of new MSSP customers, from discovery and design through integration, testing, acceptance and SOC handover.

Required profile

• 5+ years of cybersecurity, security platform, SOC, security data or security infrastructure engineering experience.
• 3+ years of hands-on experience designing, deploying, maintaining or upgrading SIEM and/or SOAR platforms in an enterprise, MSSP, MDR, SOC or security consulting environment.
• Experience with agent deployment, patching, collector and forwarder management, connector updates, platform upgrades, change control, rollback planning and production validation.
• Ability to produce architecture diagrams, technical documentation, runbooks and onboarding artefacts.

Required skills

• Hands-on experience with at least one major SIEM platform (e.g. Microsoft Sentinel, Splunk, Cortex XSIAM, FortiSIEM, QRadar).
• Hands-on experience with at least one SOAR or automation platform (e.g. Cortex XSOAR, FortiSOAR, Splunk SOAR, Azure Logic Apps).
• Strong understanding of security telemetry across cloud, SaaS, identity, endpoint, network, application and database environments.
• Working knowledge of APIs, scripting, automation, secrets handling and production support.
• Preferred: Microsoft SC-200, SC-100, AZ-500, Splunk, XSOAR, Fortinet NSE, GIAC or CISSP certifications, and training in MITRE ATT&CK, detection engineering, threat hunting, purple teaming, cloud security, platform engineering or DevSecOps.