Security Delivery Manager

Role overview

SIEM and logging delivery

• Lead log-source assessment, onboarding, and validation into enterprise SIEM platforms; Splunk is preferred.
• Define logging requirements for monitoring, detection, and investigation use cases.
• Oversee source identification, ingestion, parsing, field extraction, normalization, and validation.
• Assess log quality and security value, identify gaps, and ensure required events and fields reach monitoring teams.

Technical and delivery leadership

• Troubleshoot complex log ingestion, parsing, mapping, and data-quality issues.
• Apply common logging formats and protocols and standardize data across technology environments.
• Work with detection teams to ensure telemetry supports defined use cases.
• Coordinate dependencies across application, infrastructure, platform, and cybersecurity teams.
• Lead batch, wave, or phased onboarding based on delivery priorities and technical readiness.

Service management and governance

• Manage delivery plans, progress, risks, issues, dependencies, and stakeholder reporting.
• Set quality criteria and ensure onboarding meets technical and operational requirements.
• Prepare assessments, onboarding documentation, status reports, and management updates.
• Facilitate working sessions, resolve blockers, improve processes and standards, and coordinate cybersecurity and technology stakeholders.

Required experience and skills

• Strong hands-on SIEM knowledge; Splunk is preferred.
• Experience with log onboarding, ingestion, parsing, field extraction, log quality, and logging requirements for security use cases.
• Knowledge of security logging across operating systems, applications, network devices, and security technologies.
• Knowledge of syslog, JSON, and Windows event formats; understanding of normalization, standardization, and mapping.
• Working knowledge of detection engineering and telemetry for security detections.
• Experience coordinating technical teams and managing structured, phased, or batch-based delivery.
• Strong analytical troubleshooting, documentation, reporting, presentation, stakeholder, and communication capabilities.

Additional experience welcomed

• Large-scale enterprise SIEM or security-monitoring delivery is a bonus.
• Splunk administration, SPL, data models, or Common Information Model experience is a bonus.
• SOC operations, threat detection, incident investigation, threat hunting, cloud or hybrid environments, MITRE ATT&CK, relevant certifications, and managed security services experience are bonuses.