The posting
Netradyne harnesses the power of Computer Vision and Edge Computing to revolutionize the modern-day transportation ecosystem. We are a leader in fleet safety solutions. With growth exceeding 4x year over year, our solution is quickly being recognized as a significant disruptive technology. Our team is growing, and we need forward-thinking, uncompromising, competitive team members to continue to facilitate our growth.
About Netradyne and the Global SOC
Netradyne builds AI-powered video telematics and fleet safety solutions, led by its Driver-i platform, used by commercial fleets worldwide. Our environment spans cloud-native SaaS, edge IoT devices in vehicles, large volumes of video and telemetry data, and AI/ML platforms.
The Global SOC protects this footprint around the clock. It runs a multi-cloud SOC integrating SIEM, SOAR, threat intelligence, endpoint, identity, email, SaaS and cloud telemetry, and is moving to an AI-driven operating model with agentic triage, correlation and response under human approval controls. The SOC also supports ISO 27001 and ISO/IEC 42001 governance and the AI Security Posture Management (AISPM) program.
Role purpose
You will lead investigations that L1 cannot close, drive incidents to containment, and continuously raise the quality of our detections. You will be a hands-on technical leader on shift: mentoring L1 analysts, tuning the AI-assisted triage pipeline, and turning every incident into better playbooks, detections and controls across AWS, Azure, SaaS, endpoints and our IoT fleet platform.
Key responsibilities
Monitoring, triage and investigation
- Act as the L2/L3 escalation point for alerts across SIEM, EDR, identity, email, SaaS and cloud security tools.
- Perform deep-dive investigations correlating logs, endpoint telemetry, network data, cloud audit trails and threat intelligence.
- Validate, enrich and prioritize alerts using a risk-based approach, and reduce false positives at source.
- Review and quality-check L1 triage decisions and AI-generated triage recommendations before closure.
Incident response
- Lead security incidents through detection, containment, eradication, recovery and post-incident review.
- Coordinate with Engineering, SRE, IT, Legal and Privacy during incidents, and communicate status clearly to SOC leadership.
- Perform host and cloud forensics triage, malware analysis at a functional level, and evidence preservation.
- Write incident reports and root-cause analyses with concrete, tracked remediation actions.
Detection engineering and threat hunting
- Build, test and tune detection rules and correlation logic, mapped to MITRE ATT&CK.
- Run hypothesis-driven threat hunts across cloud, endpoint, identity and SaaS telemetry.
- Track coverage gaps and propose new log sources, detections and use cases.
- Operationalize threat intelligence (IOCs, TTPs, advisories) relevant to SaaS, cloud and IoT environments.
Automation and AI-driven SOC
- Design and improve SOAR playbooks for enrichment, triage and response.
- Help define and validate AI agent workflows, confidence thresholds, guardrails and human-approval gates for security operations.
- Monitor AI security signals from the AISPM program, including shadow AI, unauthorized agents, unregistered MCP services and data-leakage alerts.
Process, metrics and mentoring
- Maintain runbooks, playbooks, escalation matrices and SOPs.
- Track and improve SOC metrics such as MTTD, MTTR, SLA adherence and false-positive rate.
- Mentor and coach L1 analysts, run shift handovers and knowledge-sharing sessions.
- Provide evidence and support for ISO 27001, ISO/IEC 42001 and customer security audits.
Required qualifications
- Bachelor's degree in Computer Science, IT, Cybersecurity or equivalent practical experience.
- 5–8 years in information security, with 3+ years in a SOC at L2 or L3.
- Hands-on expertise with at least one enterprise SIEM (Splunk, Wazuh, QRadar or similar), including writing queries and detection rules.
- Strong experience with EDR/XDR platforms such as CrowdStrike Falcon or Microsoft Defender.
- Solid understanding of AWS and Azure security logging and services (CloudTrail, GuardDuty, Security Hub, Entra ID, Defender for Cloud).
- Working knowledge of identity attacks and controls: SSO, federation, MFA, conditional access, privileged access.
- Proven incident handling experience, including ransomware, phishing/BEC, account compromise and cloud misconfiguration incidents.
- Good grasp of networking (TCP/IP, DNS, HTTP/S, VPN, firewalls, proxies) and Windows, Linux and macOS internals.
- Practical use of MITRE ATT&CK, the cyber kill chain and incident response frameworks such as NIST SP 800-61.
- Scripting ability in Python, PowerShell or Bash for automation and log analysis.
- Clear written and verbal communication, including incident reports for technical and leadership audiences.
Preferred qualifications
- Certifications such as GCIH, GCIA, GCFA, CySA+, BTL1/BTL2, CEH, or AWS/Azure security certifications (AWS Security – Specialty, AZ-500, SC-200).
- Experience building SOAR playbooks and integrating security tools through APIs.
- Exposure to LLM-based or agentic security workflows, AI security risks (prompt injection, data leakage, model abuse) and AI governance.
- Experience securing SaaS platforms, containers and Kubernetes, or IoT and edge devices.
- Digital forensics and malware analysis skills beyond triage level.
- Familiarity with ISO 27001, ISO/IEC 42001, SOC 2 or NIST CSF audit evidence.
- Experience in a product or SaaS company with a global, 24x7 customer base.
Technology environment
- SIEM and log analytics - Wazuh, Splunk, ELK
- Endpoint and XDR - CrowdStrike, Microsoft Defender
- Email security - Proofpoint
- Automation - SOAR, Python, REST APIs
- Threat intelligence - CTI feeds and platforms, MITRE ATT&CK
- Cloud - AWS, Azure, CSPM, IAM, WAF, KMS
- Identity - SSO and federation across AWS, Azure and SaaS
- AI and AI security - Azure OpenAI, LangGraph, AI registry, AISPM, MCP security
Competencies and working conditions
- Analytical rigor: follows evidence, documents reasoning, and avoids premature conclusions.
- Ownership under pressure: stays calm and decisive during live incidents.
- Communication: explains technical risk clearly to engineers and leadership alike.
- Collaboration: works across time zones with global Engineering, IT and business teams.
- Continuous learning: keeps pace with new attack techniques, cloud services and AI security risks.
- Mentoring mindset: raises the capability of the wider SOC team.
The role supports a 24x7 global SOC and involves rotational shifts and on-call escalation duty, including occasional weekends during major incidents.
We are committed to an inclusive and diverse team. Netradyne is an equal-opportunity employer. We do not discriminate based on race, color, ethnicity, ancestry, national origin, religion, sex, gender, gender identity, gender expression, sexual orientation, age, disability, veteran status, genetic information, marital status, or any legally protected status.
If there is a match between your experiences/skills and the Company's needs, we will contact you directly.
Netradyne is an equal-opportunity employer.
Applicants only - Recruiting agencies do not contact.
Recruitment Fraud Alert!
There has been an increase in fraud that targets job seekers. Scammers may present themselves to job seekers as Netradyne employees or recruiters. Please be aware that Netradyne does not request sensitive personal data from applicants via text/instant message or any unsecured method; does not promise any advance payment for work equipment set-up and does not use recruitment or job-sourcing agencies that charge candidates an advance fee of any kind. Official communication about your application will only come from emails ending in ‘@netradyne.com’ or ‘@us-greenhouse-mail.io’.
Please review and apply to our available job openings at Netradyne.com/company/careers. For more information on avoiding and reporting scams, please visit the Federal Trade Commission's job scams website.
