Service Operations Support Engineer

I. PURPOSE The Service Operations Support Engineer will provide advanced Tier 2/3 technical support across Managed Security Operations Center (MSOC) and Managed Network Operations Center (MNOC) environments. The role focuses on detection engineering, platform administration, automation, and continuous improvement to enhance operational efficiency, strengthen security detection and response capabilities, and ensure reliable service delivery. The position requires strong technical expertise in SIEM, EDR/NDR, Threat Intelligence Platforms (TIP), Network Management Systems (NMS), endpoint management, IT Service Management (ITSM), and Security Orchestration, Automation, and Response (SOAR) solutions, with an emphasis on optimizing tools, processes, and workflows. Ii. Duties And Responsibilities
• MSOC and MNOC Operations Support Provide Tier 2/3 technical support and manage escalations across security and network operations. Maintain the reliability, scalability, and availability of security platforms, log pipelines, and network monitoring systems. Investigate and resolve complex security alerts, network availability issues, telemetry interruptions, and system health concerns.
• Detection Engineering and SIEM Management Administer, maintain, and optimize enterprise SIEM platforms. Design, develop, test, deploy, and fine-tune SIEM correlation rules and detection logic to reduce false positives and identify emerging threats. Align detection capabilities with industry frameworks, including MITRE ATT&CK. Conduct regular detection rule reviews and performance assessments to improve accuracy and effectiveness.
• Automation, Scripting, and SOAR Develop, maintain, and optimize automated playbooks within SOAR platforms. Create scripts using Python, PowerShell, Bash, and REST APIs to integrate security and network tools, process complex logs, and automate repetitive operational tasks. Identify workflow inefficiencies across MSOC and MNOC operations and implement automation solutions to improve alert handling, response times, and overall productivity.
• EDR/NDR and Threat Intelligence Platform Optimization Administer, configure, and optimize Endpoint Detection and Response (EDR) and Network Detection and Response (NDR) solutions. Refine security policies, exclusion lists, and detection queries to maintain effective security visibility while minimizing performance impacts. Manage and optimize Threat Intelligence Platforms (TIP), including the automated ingestion and enrichment of threat intelligence feeds, Indicators of Compromise (IOCs), and Indicators of Attack (IOAs). Integrate threat intelligence with SIEM, EDR, NDR, and SOAR platforms to improve threat detection and incident response.
• ITSM Administration and Process Improvement Administer and configure ITSM platforms, such as ServiceNow, Jira Service Management, and ManageEngine ServiceDesk Plus, to support incident management, service requests, change management, and SLA tracking. Integrate ITSM workflows with SOAR, SIEM, NMS, and alerting platforms to streamline ticket management and automate escalation processes. Analyze operational metrics and service performance data to improve ticket routing, response efficiency, and service delivery workflows.
• Network and Endpoint Management Systems Administer, configure, and optimize NMS platforms, such as Site24x7, LibreNMS, and SolarWinds, for network monitoring, fault and performance management, and topology mapping. Manage and optimize endpoint management platforms, including ManageEngine Endpoint Central and Microsoft Intune. Fine-tune alert thresholds, polling intervals, and notification policies to reduce unnecessary alerts while maintaining visibility into critical security and availability events. Iii. Qualifications
• Minimum Educational Requirements Bachelor's degree in Computer Science, Cybersecurity, Network Engineering, or a related field, or equivalent practical experience.
• Minimum Experience and Technical Requirements MSOC/MNOC Operations Demonstrated experience supporting security and network operations, with a solid understanding of network protocols, log management, and incident management lifecycles. NMS And Endpoint Management Hands-on experience administering, configuring, and optimizing NMS solutions, such as Site24x7, LibreNMS, and SolarWinds, as well as endpoint management platforms, including ManageEngine Endpoint Central and Microsoft Intune. Detection Engineering And SIEM Proven experience developing, testing, and tuning SIEM correlation rules and detection logic using platforms such as Splunk, Rapid7, Microsoft Sentinel, Elastic, and IBM QRadar. EDR/NDR And Threat Intelligence Practical experience managing EDR/NDR solutions, such as CrowdStrike, Microsoft Defender for Endpoint, and ExtraHop, as well as TIP platforms, including MISP, ThreatConnect, Anomali, and Cyble. SOAR, Scripting, And ITSM Hands-on experience developing SOAR playbooks, creating automation scripts using Python, PowerShell, Bash, and REST APIs, and administering ITSM platforms such as ServiceNow, Jira Service Management, and ManageEngine ServiceDesk Plus.
• Competencies Demonstrates initiative in identifying operational inefficiencies and implementing improvements through tool optimization, process enhancement, and automation. Capable of working effectively in a fast-paced environment supporting 24/7 security and network operations. Possesses strong technical documentation, analytical, troubleshooting, and cross-functional communication skills. Demonstrates a continuous improvement mindset and the ability to collaborate with multiple teams to enhance operational performance.
• Preferred Certifications Security and Operations CompTIA Cybersecurity Analyst (CySA+) GIAC certifications, including GCDA, GCIH, GMON, and GCTI Splunk Core Certified Advanced Power User or Developer CrowdStrike Certified Administrator Google SecOps Administrator Google Security Operations SOAR Developer Swimlane Certified SOAR Administrator EC-Council Certified Threat Intelligence Analyst Network and Systems Cisco CCNA or CCNP CompTIA Network+ ITIL Foundation Microsoft certifications related to enterprise administration, Intune, or endpoint management IV. WORKING CONDITIONS May be required to work beyond regular business hours, including weekends and holidays, to support project deadlines, maintain operational continuity, and address urgent client incidents or service requirements.