SOC Operations Engineer

Interested in applying for this opportunity? Contact Clint Lester with Saige Partners at

Job Description:

SOC Operations Engineer

Job Location:

Onsite in Davenport, IA

Position Summary The SOC Operations Engineer is responsible for day-to-day security operations within external customer environments. This role handles security-driven tickets, performs initial investigation and validation, and executes approved response actions following documented procedures. The SOC Operations Engineer also performs routine operational maintenance on security products to ensure they remain healthy, effective, and aligned with standards. The SOC Operations Engineer is additionally responsible for supporting ongoing vulnerability management activities across managed customer environments.

This focuses on identifying, validating, tracking, and executing remediation of security weaknesses in a customer environment via a structured and repeatable manner using our toolsets. This role is for someone who thrives on investigation and decisive response. The SOC Operations Engineer builds expertise by owning security cases end-to-end within scope, executing proven playbooks, and collaborating closely with the Security Engineer on higher-complexity events.

Escalation Path Security Engineer (as required)

Key Responsibilities Security Ticket Triage and Response (Primary Responsibility)

• Own security-related tickets from creation through resolution within defined scope.
• Review alerts and cases, validate whether activity is benign or suspicious, and determine customer impact.
• Perform initial investigation using available telemetry and platform data to establish what happened and what systems or identities are involved.
• Execute approved response actions using documented runbooks (for example: isolate endpoint, disable account, block indicator, initiate scan, collect artifacts), when authorized and appropriate.
• Maintain situational awareness during active incidents and keep ticket timelines accurate and current.
• Monitor vulnerability scanning platforms and reports to identify new, recurring, or critical vulnerabilities.
• Validate scan results across all managed assets and prioritize severity, exposure and relevance.
• Apply documented prioritization criteria to determine remediation urgency.

Escalation and Collaboration

• Escalate to the Security Engineer when incidents exceed defined scope, require advanced analysis, involve high business impact, or indicate coordinated or ongoing threat activity.
• Provide high-quality handoffs including: what was observed, what was validated, actions taken, evidence collected, and recommended next steps.
• Escalate to a Team Lead for customer communication, dispatch coordination, and onsite actions when needed.
• Collaborate with NOC and Maintenance roles when incidents intersect with outages, backups, patching, identity access, or broader operational issues.
• Coordinate with internal teams and customers to support vulnerability remediation.
• Track progress and validate vulnerability remediations.
• Identify remediation issues and escape to appropriate parties.

Security Product Operations and Routine Maintenance

• Perform routine operational checks of security platforms to ensure agents, connectors, sensors, and integrations are healthy and reporting.
• Maintain baseline operational readiness for security platforms, including verifying critical coverage and reporting on gaps.
• Support routine tuning work by documenting noise patterns and proposing improvements to the Security Engineer.

Documentation and Process Adherence

• Document all investigative steps, findings, evidence, and actions taken in the ticketing system using established standards.
• Follow incident handling procedures, escalation criteria, and change management requirements when executing response actions.
• Maintain and improve SOC runbooks and quick-reference procedures for common alert types, recurring event patterns and remediations.
• Contribute to consistent, repeatable security operations across customer environments.

Professional Development Expectations

• Build proficiency in tool usage, investigation workflow, and incident response fundamentals.
• Participate in structured…