Staff Security Operations Engineer (SOC)

About the role

SHEIN is hiring a Staff Security Operations Engineer (SOC) for its global security operations function, based in Turkey. You will monitor, detect, investigate and respond to security threats across the company's IT and business systems, helping to build and continuously improve detection and response capabilities within a follow-the-sun operating model.

Key responsibilities

• Own day-to-day SOC operations, building and running mechanisms for risk identification, monitoring, alerting, response and post-incident review, supporting 7x24 coverage.
• Contribute to the security operations roadmap and standards, covering log onboarding, detection rules, alert triage, incident response, knowledge management and operational metrics.
• Monitor and triage security alerts, focusing on intrusion attempts, malware, anomalous logins, lateral movement, data exfiltration and privilege abuse.
• Build and run detection and response capabilities, including detection rules, attack samples, evaluation use cases, response SOPs and automated remediation workflows.
• Run pre-production security assessments and readiness checks for third-party components, open-source software and systems going live, and deliver risk conclusions and remediation recommendations.
• Participate in incident response, including attack-chain reconstruction, impact analysis, forensics, root-cause analysis and vulnerability remediation.
• Stay current with threat intelligence and detection engineering, turning it into detection rules, triage logic and automation.
• Collaborate with application security, data security, platform engineering, IT and business teams to improve security operations maturity and metrics.

Required profile

• Bachelor's degree or above in Cyber Security, Computer Science or a related field.
• At least five years of hands-on experience in security operations (SOC), incident response or application security.
• Proven experience performing alert analysis, attack-chain reconstruction, risk classification, remediation recommendations, post-incident reports and detection-rule tuning.
• Good English or Chinese reading, writing and communication skills, able to collaborate with cross-regional (Europe / APAC) teams and with global SOC shift work.

Required skills

• Intrusion detection, malware analysis, log analysis and threat hunting.
• Log and alert analysis across operating systems, network protocols, cloud platforms and security tooling.
• Working knowledge of common web security vulnerabilities, with some penetration testing, code review or interface security testing.
• Proficiency in Python for writing detection scripts, log-analysis scripts and automation tools.