Development of a package of vacancy texts for recruiting a SOC and IR team in fintech with reference to compliance requirements and the market

The initial situation is that a fintech company launches a 24/7 Security Operations Center and an Incident Response function within an already running infrastructure (AWS, Kubernetes, Terraform, SIEM Splunk, EDR CrowdStrike, IAM Okta, logging via Fluent Bit). Currently, job vacancies are written scatteredly, give a lot of irrelevant responses and do not undergo internal approval due to compliance requirements and precision of wording. It is necessary to prepare a package of job texts in RU for recruitment in the Russian Federation/CIS, taking into account real tasks, stacks and levels of responsibility.

Subject area - information security, SOC, incident investigation, threat hunting, response, compliance (PCI DSS, ISO 27001), interaction with development and SRE.

Specific result - 6 full texts of vacancies and accompanying materials for publication and internal approval:
- SOC Analyst L2
- SOC Analyst L3/Shift Lead
- Incident Responder (IR)
- Threat Hunter
- Detection Engineer (SIEM/EDR)
- Security Engineer (Blue Team Enablement)
Additionally - 1 unified block about the company and conditions, which can be inserted into all vacancies (2 tone options - neutral and “tech-friendly”), as well as a matrix of skills by level (must-have/nice-to-have) for recruiters.

Process requirements - work in several stages:
1) Short interview with 2-3 stakeholders (Head of Security, SOC Lead, HRBP) and analysis of current drafts/response history.
2) Market calibration - analysis of 20-30 relevant vacancies of competitors/related companies and formation of positioning (what we promise honestly, how we differ, what we don’t write).
3) Preparing drafts, agreeing on terminology and level of responsibility (especially for L2/L3 and IR).
4) Final editing for sites (HH/LinkedIn/career site) - 3 versions of headings and the first 300 characters for each text.

Restrictions - you cannot mention specific clients and internal project names, you cannot overstate authority (for example, “manage all security”), you cannot promise access to production without reservations. The text should be understandable to the candidate, but without simplifications, maintain technical accuracy and correct terms. No HTML lists, just a short hyphen.

Measurable acceptance criteria:
- For each vacancy there are separate versions: “full” (9000-12000 characters with spaces) and “short” (2500-3500 characters).
- In each vacancy: 1 clear paragraph about the purpose of the role, 1 about typical incidents/cases, separate must-have and nice-to-have blocks, transparent boundaries of responsibility, mention of interaction (Dev/SRE/Compliance).
- Terminology is consistent and uniform between all vacancies (for example, distinguishing IR vs SOC, detection engineering vs hunting).
- The skills matrix covers 6 roles and a minimum of 4 levels of proficiency (basic/confident/advanced/expert) for 12-18 key competencies (SIEM, EDR, clouds, K8s, networking, forensics, scripting, MITER ATT&CK, playbooks, etc.).
- The final package is provided in Google Docs + a separate file with titles/teasers in CSV format for uploading to ATS.

Professional tools - expected to work confidently with Google Docs (comments/versions), job market analytics (HH, LinkedIn, Glassdoor/analogs), use of competency frameworks (for example, MITER ATT&CK, NIST IR) to correctly describe tasks, basic work with tables (Google Sheets) for the skills matrix.

At the entrance we will provide current drafts of 3 vacancies, a description of the stack, organizational structure, statistics on responses for 2 months and an NDA/restrictions template. The output is a package ready for publication without additional editing.