Netradyne harnesses the power of Computer Vision and Edge Computing to revolutionize the modern-day transportation ecosystem. We are a leader in fleet safety solutions. With growth exceeding 4x year over year, our solution is quickly being recognized as a significant disruptive technology. Our team is growing, and we need forward-thinking, uncompromising, competitive team members to continue to facilitate our growth.

About Netradyne and the Global SOC

Netradyne builds AI-powered video telematics and fleet safety solutions, led by its Driver-i platform, used by commercial fleets worldwide. Our environment spans cloud-native SaaS, edge IoT devices in vehicles, large volumes of video and telemetry data, and AI/ML platforms.

The Global SOC protects this footprint around the clock. It runs a multi-cloud SOC integrating SIEM, SOAR, threat intelligence, endpoint, identity, email, SaaS and cloud telemetry, and is moving to an AI-driven operating model with agentic triage, correlation and response under human approval controls. The SOC also supports ISO 27001 and ISO/IEC 42001 governance and the AI Security Posture Management (AISPM) program.

Role purpose

You will lead investigations that L1 cannot close, drive incidents to containment, and continuously raise the quality of our detections. You will be a hands-on technical leader on shift: mentoring L1 analysts, tuning the AI-assisted triage pipeline, and turning every incident into better playbooks, detections and controls across AWS, Azure, SaaS, endpoints and our IoT fleet platform.

Key responsibilities

Monitoring, triage and investigation

Act as the L2/L3 escalation point for alerts across SIEM, EDR, identity, email, SaaS and cloud security tools.
Perform deep-dive investigations correlating logs, endpoint telemetry, network data, cloud audit trails and threat intelligence.
Validate, enrich and prioritize alerts using a risk-based approach, and reduce false positives at source.
Review and quality-check L1 triage decisions and AI-generated triage recommendations before closure.

Incident response

Lead security incidents through detection, containment, eradication, recovery and post-incident review.
Coordinate with Engineering, SRE, IT, Legal and Privacy during incidents, and communicate status clearly to SOC leadership.
Perform host and cloud forensics triage, malware analysis at a functional level, and evidence preservation.
Write incident reports and root-cause analyses with concrete, tracked remediation actions.

Detection engineering and threat hunting

Build, test and tune detection rules and correlation logic, mapped to MITRE ATT&CK.
Run hypothesis-driven threat hunts across cloud, endpoint, identity and SaaS telemetry.
Track coverage gaps and propose new log sources, detections and use cases.
Operationalize threat intelligence (IOCs, TTPs, advisories) relevant to SaaS, cloud and IoT environments.

Automation and AI-driven SOC

Design and improve SOAR playbooks for enrichment, triage and response.
Help define and validate AI agent workflows, confidence thresholds, guardrails and human-approval gates for security operations.
Monitor AI security signals from the AISPM program, including shadow AI, unauthorized agents, unregistered MCP services and data-leakage alerts.

Process, metrics and mentoring

Maintain runbooks, playbooks, escalation matrices and SOPs.
Track and improve SOC metrics such as MTTD, MTTR, SLA adherence and false-positive rate.
Mentor and coach L1 analysts, run shift handovers and knowledge-sharing sessions.
Provide evidence and support for ISO 27001, ISO/IEC 42001 and customer security audits.

Required qualifications

Bachelor's degree in Computer Science, IT, Cybersecurity or equivalent practical experience.
5–8 years in information security, with 3+ years in a SOC at L2 or L3.
Hands-on expertise with at least one enterprise SIEM (Splunk, Wazuh, QRadar or similar), including writing queries and detection rules.
Strong experience with EDR/XDR platforms such as CrowdStrike Falcon or Microsoft Defender.
Solid understanding of AWS and Azure security logging and services (CloudTrail, GuardDuty, Security Hub, Entra ID, Defender for Cloud).