Senior Security Operations Engineer (SIEM / SOAR)

Role overview

SIEM engineering and migration

• Deploy, configure, maintain, and optimize QRadar and Sentinel; design log collection, retention, workspace, and scaling architecture.
• Onboard and normalize network, endpoint, identity, cloud, database, and core banking logs; monitor ingestion health and resolve gaps.
• Manage upgrades, patching, licensing, and capacity; migrate QRadar content to Sentinel while preserving detection coverage and data access.

Detection, automation, and operations

• Develop and tune MITRE ATT&CK-aligned detections and banking use cases for fraud, privileged access misuse, payment systems, and data exfiltration.
• Build Logic Apps and/or QRadar SOAR playbooks; automate response workflows and integrate ITSM, EDR, threat intelligence, and identity platforms.
• Support SOC analysts and incident responders; maintain runbooks and architecture documentation; assist audits and report platform and SOC metrics.

Essential requirements

• 5–10 years in security operations, SIEM engineering, or related cybersecurity work.
• Hands-on IBM QRadar and Microsoft Sentinel experience, including platform configuration, connectors, rules, workbooks, and automation.
• Strong KQL and working AQL knowledge; practical SOAR automation experience.
• Knowledge of log sources and pipelines, MITRE ATT&CK, Azure, Microsoft Defender XDR, and Microsoft Entra ID.
• PowerShell and/or Python scripting ability.
• Bachelor’s degree in a related field or equivalent professional experience.

Desirable qualifications

• QRadar-to-Sentinel migration, banking or financial services, and large, regulated, or 24x7 SOC experience are highly desirable.
• Infrastructure-as-code, CI/CD for detection content, and threat intelligence or EDR integration experience are desirable.
• Preferred certifications include SC-200, IBM QRadar certifications, and relevant GIAC or CISSP credentials.

Key competencies