Lead SecOps Engineer

We are looking for a Lead SecOps Engineer to help protect our systems, applications, and data from evolving threats. You'll work at the intersection of security monitoring, incident response, and automation — building the detection and response capabilities that keep our environment secure.

Responsibilities

• Monitor security alerts and logs across endpoints, network, cloud, and applications (SIEM/SOAR platforms)
• Investigate and respond to security incidents, performing triage, containment, and root-cause analysis
• Develop and tune detection rules, correlation logic, and alerting to reduce false positives and close coverage gaps
• Build and maintain automation/playbooks for incident response (SOAR)
• Conduct vulnerability management, including scanning, prioritization, and coordinating remediation with engineering teams
• Perform threat hunting to proactively identify malicious activity
• Support security tooling deployment and integration (EDR, SIEM, cloud security posture tools, IAM)
• Participate in on-call rotation for security incidents
• Contribute to post-incident reviews and documentation (runbooks, RCAs)
• Collaborate with IT, DevOps, and engineering to harden infrastructure and enforce security best practices
• Assist with compliance/audit activities (SOC 2, ISO 27001, etc.) as needed

Requirements

• 5+ years of experience in security operations, incident response, or a related field
• At least 1 year of relevant leadership experience
• Hands-on expertise in SIEM (Splunk, Sentinel, Elastic, QRadar) and EDR tools
• Solid understanding of networking, operating systems (Linux/Windows), and cloud environments (AWS, Azure, GCP)
• Familiarity with common attack techniques and frameworks (MITRE ATT&CK, NIST Cybersecurity Framework)
• Scripting proficiency in Python, Bash, or PowerShell for automation and tooling
• Background in vulnerability management and remediation workflows
• Strong analytical and problem-solving skills; calm under pressure during incidents
• Clear written and verbal communication for documentation and cross-team collaboration (B2 English proficiency)

Nice to have

• Experience with SOAR platforms (Palo Alto XSOAR, Tines)
• Security certifications (Security+, GCIH, GCIA, CISSP, OSCP)
• Background in threat intelligence or purple/red team collaboration
• Familiarity with container/Kubernetes security
• Experience in a regulated industry (finance)

We offer

With us you can:

• Work on a flexible schedule remotely or from any of our comfortable offices or coworking spaces in Ukraine
• Receive the necessary equipment to perform your work tasks
• Change projects and technology stacks within EPAM
• Gain experience in various business domains (Insurance, E-commerce, Healthcare, Finance, Travelling, Media, Artificial Intelligence, and more)
• Relocation opportunities may be available for eligible candidates, depending on the role and openings at other EPAM locations
• Participate in volunteer, charity programs and communities (both technical and interest-based)

We focus on your professional growth:

• You can plan your individual career path together with your manager
• Receive regular feedback from colleagues
• Improve your English for free with certified teachers (Speaking Clubs, client interview preparation courses, etc.)
• Get the opportunity to undergo free training and certification in AWS, GCP, or Azure Clouds
• Use the internal E-learn training program (18,200+ specialized training and mentoring programs)
• Access corporate accounts on LinkedIn Learning, Get Abstract and other partner resources
• Study at EPAM Solution Architecture School with the instructors who are practicing architects
• Develop as a leader, join Delivery Management, Resource Management, Leadership Essentials school and more
• Participate in internal communities (500+ meetups, technical discussions, brainstorming sessions, online events and conferences annually)

What we offer:

• Vacation and sick leave (including a sick leave without a medical certificate)
• A wide range of Voluntary Medical Insurance programs providing both medical treatment and various preventive options (including sports activities)
• Medical insurance for family members at corporate rates
• Company support during significant life events (childbirth or adoption, marriage, etc.)
• Support for psychological comfort: discounts on services from mental health specialists or coaches, thematic training
• E-kids program - a free programming language training program for EPAMers' children

Kindly note that this role supports remote work, but only from within Ukraine.

Kindly be advised that the set of benefits, including learning, certification, and other opportunities, may vary depending on the role you apply for. Our recruiter will be able to share more details about the specific opportunity during your general interview.

EPAM strives to provide its global team of over 62,350 professionals in more than 55 countries with opportunities for professional growth from day one of collaboration. Our colleagues are the source of EPAM's success, so we value cooperation, strive to always understand our clients' business and aim for the highest quality standards. No matter where you are, you will join a dedicated, diverse community that will help you realize your potential to the fullest.

Remote in Ukraine