Security Delivery Manager

Role overview

SIEM and logging delivery

• Lead log-source assessment, onboarding, and validation into enterprise SIEM platforms; Splunk is preferred.
• Define and govern logging requirements aligned with monitoring, detection, and investigation use cases.
• Oversee source identification, ingestion, parsing, field extraction, normalization, and validation.
• Assess log quality, completeness, consistency, and security value; identify gaps and recommend remediation.
• Ensure required security events and fields are accurately captured and available to monitoring and detection teams.

Technical and delivery leadership

• Provide technical direction and troubleshooting for complex ingestion, parsing, mapping, and data-quality issues.
• Apply knowledge of syslog, JSON, Windows Event Logs, and application logs.
• Drive consistent data normalization and standardization across technology environments.
• Collaborate with detection teams to ensure telemetry meets defined use-case requirements.
• Coordinate dependencies across application, infrastructure, platform, and cybersecurity teams.
• Lead batch-based, wave-based, or phased onboarding based on priorities, dependencies, and technical readiness.

Service management and governance

• Own delivery planning and tracking of progress, risks, issues, dependencies, and stakeholder reporting.
• Establish quality criteria and ensure onboarding outputs meet technical and operational requirements.
• Produce assessments, onboarding documentation, status reports, and management updates.
• Facilitate working sessions to resolve blockers and maintain delivery momentum.
• Improve onboarding processes, logging standards, operational efficiency, and monitoring coverage.

Required qualifications

• Strong hands-on understanding of SIEM technologies; Splunk is preferred.
• Demonstrated experience with log onboarding, ingestion pipelines, parsing, and field extraction.
• Strong understanding of security logging across operating systems, applications, network devices, and security technologies.
• Knowledge of syslog, JSON, and Windows events.
• Experience assessing and improving log quality, completeness, and consistency.
• Experience defining logging requirements for security monitoring and detection use cases.
• Working knowledge of detection engineering and telemetry's role in detections.
• Understanding of security-data normalization, standardization, and mapping.
• Strong analytical and troubleshooting capabilities for ingestion and data-quality issues.
• Experience coordinating with application, infrastructure, platform, and security teams; managing structured, phased, or batch-based technology delivery.
• Strong documentation, reporting, presentation, stakeholder-management, and communication capabilities.

Preferred experience

• Large-scale enterprise SIEM or security-monitoring delivery experience is a bonus.
• Splunk administration, SPL, data models, or Common Information Model experience is a bonus.
• SOC operations, threat detection, incident investigation, or threat-hunting exposure is a bonus.
• Cloud and hybrid environment experience is a bonus.
• Familiarity with MITRE ATT&CK and security-monitoring frameworks is a bonus.
• Relevant cybersecurity, SIEM, Splunk, or service-management certifications are a bonus.
• Managed Security Services experience is a bonus.