Machine speed. Human judgment.
Automation removes the latency. It does not remove the responsibility. Every layer of this SOC has a person who owns the call, and the interesting part of the job is being that person.
Vijilan runs a 24/7 security operations centre for MSPs, MSSPs and enterprises, built on CrowdStrike Falcon and our own Praxis AI platform. Hiring falls into three tracks: Praxis AI engineering, security operations, and go-to-market.
The SOC is organized in four layers, and they are also the progression path: triage (what fired and does it matter), enrichment (what else is true about it), escalation (is it real and how bad), containment (make it stop without breaking the business). Most people join at triage. Nobody is left there.
The position on automation is the same one we take publicly with clients: agents do the reversible work at machine speed, and a person owns every irreversible decision. That is a deliberate design choice about accountability rather than a gap we are closing.
Four layers, and a way through them.
This is how the SOC is organized and how people move through it. The line is the point: it runs in one direction, and the roles hang off it.
- 01Triage
What just fired, and does it matter
- 02Enrichment
What else is true about it
- 03Escalation
Is this real, and how bad
- 04Containment
Make it stop, without breaking the business
First contact with everything the platform sees. You learn the estate fast here, because you see all of it. Most people start on this layer and nobody is left on it.
Intelligence, asset context and history turn an alert into a picture. This is where pattern recognition starts paying, and where the detection content you write begins to outlive the shift.
The investigation layer. You decide what is genuinely happening, you own the call, and you write the account of it that the client reads. Judgment, not throughput.
Action under an approved mandate, at the hour it is needed. The hardest layer, because the cost of being wrong is real in both directions and somebody has to decide anyway.
Nothing open this minute.
Roles here open in waves rather than continuously, and there is no wave running today. That is worth saying plainly rather than leaving a page of stale postings up.
If you work on one of the four layers above, or you build the platform underneath them, tell us now rather than watching this page. We keep a real list and we read it when a wave opens.
Introduce yourselfFour steps, and a promise about speed.
- 01Apply
A form, a resume, and no account to create. Fifteen minutes, not an evening.
- 02First conversation
Thirty minutes with the hiring manager about the actual work. Within a week of applying.
- 03The real one
A working session on a problem from the floor. No whiteboard algorithms, no trick questions.
- 04Decision
A yes or a no, with a reason, inside two weeks of the first conversation.
Including the one about AI reading your resume.
Do you hire people without a security background?
For the triage layer, yes, and we have. What is hard to teach is the habit of following something until it actually makes sense rather than until it looks plausible. What is straightforward to teach is the tooling. If you have that habit from another technical field, apply and say so in the cover note.
Is this remote?
It varies by role and each posting states its own arrangement rather than leaving it to be discovered at offer stage. Security operations roles carry a shift note for the same reason: a rotation you learn about late is a rotation you resent.
What does progression actually look like?
The four SOC layers on this page are a path, not a chart. Most people join at triage and move through enrichment into escalation or containment as they demonstrate the judgment each one needs. That progression is the reason the layers are drawn here at all.
Do you use AI to review applications?
Where we do, the posting says so plainly, and a human makes every decision about every candidate. We are not going to automate a rejection. Any use of automated analysis is disclosed on the posting itself rather than buried in a privacy policy.
There are no openings listed. Should I still get in touch?
Yes. The Talent Community posting exists for exactly that, and roles open in waves rather than continuously. Telling us what you do well now is more useful than watching this page.
Vijilan Security is an equal opportunity employer. We consider every qualified applicant without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other protected characteristic. If you need an accommodation at any point in the process, say so and we will arrange it.
Not the right moment
but the right work?
Roles open in waves. Telling us what you do well now is more useful than checking this page, and it is the list we actually read when the next wave opens.