Security Delivery Manager

Role overview

SIEM and logging delivery

• Lead log-source assessment, onboarding, and validation into enterprise SIEM platforms; Splunk is preferred.
• Define logging requirements for monitoring, detection, and investigation use cases.
• Oversee source identification, ingestion, parsing, field extraction, normalization, and validation.
• Assess log quality and security value, identify gaps, and ensure required events and fields reach monitoring teams.

Technical and delivery leadership

• Troubleshoot complex ingestion, parsing, mapping, and data-quality issues and provide technical direction.
• Apply common logging formats and protocols, including syslog, JSON, Windows Event Logs, and application logs.
• Coordinate technical dependencies and phased onboarding across application, infrastructure, platform, and cybersecurity teams.
• Collaborate with detection teams to align telemetry with use-case requirements.

Service management and governance

• Plan delivery and track progress, risks, issues, dependencies, and stakeholder reporting.
• Establish quality criteria and produce assessments, onboarding documentation, status reports, and management updates.
• Facilitate working sessions, resolve blockers, and improve onboarding processes, standards, efficiency, and monitoring coverage.

Required experience and knowledge

• Strong hands-on SIEM knowledge; Splunk is preferred.
• Experience with log onboarding, ingestion pipelines, parsing, and field extraction.
• Knowledge of security logging across operating systems, applications, network devices, and security technologies.
• Knowledge of syslog, JSON, Windows events, log-quality assessment, logging requirements, detection engineering, and security-data normalization.

Delivery and communication qualifications

• Experience coordinating application, infrastructure, platform, and security teams and managing phased or batch-based technology delivery.
• Strong analytical troubleshooting, documentation, reporting, presentation, stakeholder-management, and communication capabilities.

Additional preferred experience

• Bonus experience includes large-scale enterprise SIEM or security-monitoring delivery; Splunk administration, SPL, data models, or Common Information Model concepts.
• Other bonus areas include SOC operations, threat detection, incident investigation, threat hunting, cloud or hybrid environments, and familiarity with MITRE ATT&CK or security-monitoring frameworks.