Machine speed. Human judgment.
Automation removes the latency. It does not remove the responsibility. Every layer of this SOC has a person who owns the call, and the interesting part of the job is being that person.
We move quickly, we build our own tools, and we are unreasonable about one thing: our customers and partners being glad they chose us. Their success is our success. If that sounds like the kind of place you do your best work, we should talk.
Vijilan runs a 24/7 security operations centre for MSPs, MSSPs and enterprises, built on CrowdStrike Falcon and our own Praxis AI platform. Hiring falls into three tracks: Praxis AI engineering, security operations, and go-to-market.
The SOC is organized in four layers, and they are also the progression path: triage (what fired and does it matter), enrichment (what else is true about it), escalation (is it real and how bad), containment (make it stop without breaking the business). Most people join at triage. Nobody is left there.
The position on automation is the same one we take publicly with clients: agents do the reversible work at machine speed, and a person owns every irreversible decision. That is a deliberate design choice about accountability rather than a gap we are closing.
It is a fast-moving company organized around its customers and partners, on the principle that their success is our success. The six things that predict doing well here: genuine passion for security, clear communication under pressure, accountability without being chased, humility, initiative, and following work through to closure rather than out of your queue.
Their success is our success.
That is not a slogan on a wall here, it is how the work is judged. MSPs, MSSPs and enterprises hand us the part of their business that cannot fail quietly. When their client sleeps through an incident because we caught it, that is the whole job.
So we are obsessive about customer happiness in a slightly literal way. We ask. We read the answers. We change what we do because of them. You will hear about a partner’s bad week in a company meeting, and you will hear what we did about it.
We also build. Praxis AI™ is ours, and the SOC platform, the detection content and the automation around it are written by the people who use them. There is very little distance here between noticing something is broken and being the one who fixes it.
Six things we look for.
Passionate about security
You read about this stuff when nobody is paying you to. You have an opinion about a recent breach and a reason behind it. Credentials are welcome, curiosity is the requirement.
A genuinely good communicator
You can explain an incident to an engineer and to a business owner in the same hour, and both walk away clear. Most of the value a SOC delivers is transmitted in writing at an awkward time of night.
Accountable without being asked
When something goes wrong on your watch you say so first, with what you know and what you are doing about it. Nobody here has to find out from somewhere else.
Humble
You would rather be corrected than be right. You ask the question you think is obvious, which is usually the one everyone else was also sitting on.
A go-getter
You see the gap and start closing it instead of filing it. Small company, real ownership: the thing you notice is usually yours to fix.
You follow through to closure
Done means the client has an answer and the ticket tells the truth, not that it left your queue. This is the one we are strictest about.
Nobody arrives with all six fully formed. Bring four and the willingness to be told about the other two.
Four layers, and a way through them.
This is how the SOC is organized and how people move through it. The line is the point: it runs in one direction, and the roles hang off it.
- 01Triage
What just fired, and does it matter
- 02Enrichment
What else is true about it
- 03Escalation
Is this real, and how bad
- 04Containment
Make it stop, without breaking the business
First contact with everything the platform sees. You learn the estate fast here, because you see all of it. Most people start on this layer and nobody is left on it.
Intelligence, asset context and history turn an alert into a picture. This is where pattern recognition starts paying, and where the detection content you write begins to outlive the shift.
The investigation layer. You decide what is genuinely happening, you own the call, and you write the account of it that the client reads. Judgment, not throughput.
Action under an approved mandate, at the hour it is needed. The hardest layer, because the cost of being wrong is real in both directions and somebody has to decide anyway.
Nothing open this minute.
Roles here open in waves rather than continuously, and there is no wave running today. That is worth saying plainly rather than leaving a page of stale postings up.
If you work on one of the four layers above, or you build the platform underneath them, tell us now rather than watching this page. We keep a real list and we read it when a wave opens.
Introduce yourselfIntroduce yourself
No account, no resume upload, no cover letter. Tell us what you are good at and we will come back to you when something fits.
Four steps, and a promise about speed.
- 01Apply
A form, a resume, and no account to create. Fifteen minutes, not an evening.
- 02First conversation
Thirty minutes with the hiring manager about the actual work. Within a week of applying.
- 03The real one
A working session on a problem from the floor. No whiteboard algorithms, no trick questions.
- 04Decision
A yes or a no, with a reason, inside two weeks of the first conversation.
Including the one about AI reading your resume.
Do you hire people without a security background?
For the triage layer, yes, and we have. What is hard to teach is the habit of following something until it actually makes sense rather than until it looks plausible. What is straightforward to teach is the tooling. If you have that habit from another technical field, apply and say so in the cover note.
Is this remote?
It varies by role and each posting states its own arrangement rather than leaving it to be discovered at offer stage. Security operations roles carry a shift note for the same reason: a rotation you learn about late is a rotation you resent.
What does progression actually look like?
The four SOC layers on this page are a path, not a chart. Most people join at triage and move through enrichment into escalation or containment as they demonstrate the judgment each one needs. That progression is the reason the layers are drawn here at all.
Do you use AI to review applications?
Where we do, the posting says so plainly, and a human makes every decision about every candidate. We are not going to automate a rejection. Any use of automated analysis is disclosed on the posting itself rather than buried in a privacy policy.
There are no openings listed. Should I still get in touch?
Yes. The Talent Community posting exists for exactly that, and roles open in waves rather than continuously. Telling us what you do well now is more useful than watching this page.
Vijilan Security is an equal opportunity employer. We consider every qualified applicant without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other protected characteristic. If you need an accommodation at any point in the process, say so and we will arrange it.
Not the right moment
but the right work?
Roles open in waves. Telling us what you do well now is more useful than checking this page, and it is the list we actually read when the next wave opens.