Lead SOC Engineer (SIEM & SOAR)

Role overview

Responsibilities

• Onboard log sources with asset owners, client stakeholders, and SOC teams.
• Govern critical SOC log sources, troubleshoot issues, and coordinate timely resolution with customers.
• Optimize telemetry, data collection, correlation, and reporting; perform system updates and resolve Splunk issues.
• Maintain SIEM/SOAR performance and design SOAR playbooks for incident automation and orchestration.
• Integrate SOAR with SIEM, ticketing, threat intelligence, and endpoint tools.
• Improve SOC processes, report on services and operations, and contribute to Splunk-related SOC architecture initiatives.
• Mentor and develop junior SOC engineers.

Experience and education

• At least 8 years of SOC operations experience, including significant Splunk SIEM management experience.
• Prior technical experience in a SOC or similar cybersecurity environment.
• Bachelor’s degree in computer science, information technology, cybersecurity, or a related field.

Technical qualifications

• Splunk SIEM/SOAR, SPL mastery, field extractions, data normalization, and CIM compliance.
• Python scripting; knowledge of CRIBL and SOAR platforms such as Forti SOAR, Splunk SOAR (Phantom), or Cortex XSOAR.
• Understanding of SOC workflows, MITRE ATT&CK, threat detection, cloud and network technologies, and cybersecurity practices.
• Splunk Certified Architect or Splunk Certified Administrator certification.
• Cloud solutions architect certification is listed among qualifications. CISSP or GIAC is preferred; CCNA or CCNP is advantageous.

Professional capabilities

• Troubleshoot cloud- and network-related log-source issues and correlate data across sources to identify patterns and anomalies.
• Communicate and collaborate effectively with SOC colleagues and customers; solve problems and make decisions under pressure.