Purple Operations Engineer

📋 Description

• Tune EDR, SIEM, and XDR detections to reduce false positives and improve alert quality.
• Build and maintain detection rules, correlation searches, dashboards, watchlists, and response workflows.
• Translate Red Team, Purple Team, incidents, and Threat Intelligence findings into repeatable defensive checks.
• Validate that EDR policies, logging, sensor health, and response actions work as expected.
• Review noisy alerts and tune thresholds, exclusions, lookups, entity context, and suppression logic.
• Support SOC analysts with clear alert descriptions, triage steps, severity logic, and escalation guidance.

🎯 Requirements

• Experience tuning EDR, SIEM, XDR, or SOC monitoring platforms.
• Strong understanding of endpoint, identity, cloud, network, and web attack behaviors.
• Practical experience writing detection logic in KQL, SPL, EQL, Lucene, Sigma, YARA, or similar.
• Familiarity with MITRE ATT&CK mapping and detection coverage analysis.
• Ability to turn Red Team, Purple Team, and incident findings into clear detection logic.
• Experience reducing false positives through rule tuning, automation, and better entity context.

🎁 Benefits

• Remote first company in pursuit of sustainability.
• Competitive salary + quarterly bonuses.
• 28 days paid annual leave.
• Core working hours are 10am-3pm in your local time zone with flexibility outside.
• Referral bonuses & flash bonuses.
• Annual company retreats.