SOC Engineer (Incident Response)

About the role

Binance is seeking a SOC Engineer focused on incident response and data loss prevention. The role combines hands‑on security operations with the design and implementation of automation and custom tooling to protect a global blockchain ecosystem.

Key responsibilities

• Design, develop, and maintain security automation and SOC tooling, integrating with SIEM, EDR, cloud services, and internal platforms.
• Create services, scripts, and pipelines to automate alert enrichment, correlation, response, and investigation workflows.
• Build and sustain API‑based integrations with security tools, AWS services, and internal systems.
• Support and enhance SIEM platforms for data ingestion, alerting, and investigation.
• Participate in detection engineering, including log parsing, data normalization, and detection rule implementation.
• Assist in incident response activities: triage, investigation, containment, eradication, and post‑incident analysis.
• Take part in SOC on‑call rotation, responding to security alerts and incidents as required.
• Collaborate with SOC analysts to translate operational needs into scalable engineering solutions and optimise existing automation, CI/CD pipelines, and platform components.

Required profile

• 4+ years of experience in a SOC or security operations role with a focus on incident response.
• Proven experience designing, deploying, and monitoring Data Loss Prevention (DLP) solutions.
• Hands‑on threat hunting, forensic analysis, and APT detection experience.
• Familiarity with SIEM, EDR, and cloud security architectures.
• Knowledge of encryption, tokenisation, and data classification methods.

Required skills

• Programming/scripting: macOS Swift, Unix socket programming, general scripting (e.g., Python, Bash).
• Security automation and CI/CD pipeline development.
• API integration with security tools and AWS services.
• Experience with SIEM and EDR platforms.
• Understanding of cloud services (AWS) and security architectures.