Senior Security Operations Engineer (SIEM / SOAR) (m/f/d)

Role overview

SIEM platforms and modernization

• Design, implement, and maintain IBM QRadar and Microsoft Sentinel platforms.
• Manage log onboarding, parsing, normalization, and monitoring across infrastructure, cloud, identity, applications, databases, and endpoints.
• Design SIEM architecture, retention, workspaces, performance optimization, and capacity planning; monitor platform health and log collection.
• Manage upgrades, lifecycle, maintenance, and optimization.
• Support or lead SIEM transformations and migrations, translate detection content, and preserve monitoring coverage and historical log access.

Detection, automation, and operations

• Develop and tune detections aligned with threat intelligence and MITRE ATT&CK; improve use cases, alert fidelity, and false-positive rates.
• Design SOAR workflows and playbooks; automate enrichment, investigation, triage, containment, notification, and response.
• Integrate SIEM and SOAR with EDR, threat intelligence, identity, and ITSM solutions.
• Support SOC analysts and incident response teams during major security events.
• Maintain documentation, architecture diagrams, runbooks, and procedures; support audits and report performance and coverage metrics.

Required skills and experience

• 5–10 years in Security Operations, SIEM Engineering, Detection Engineering, or Cybersecurity Operations.
• Expertise in IBM QRadar, Microsoft Sentinel, SIEM engineering, SOAR automation, detection engineering, and security monitoring.
• Hands-on KQL, AQL, Sentinel Analytics Rules, QRadar Rule Development, log parsing and normalization; experience with Syslog, CEF, APIs, AMA, and DCRs.
• Understanding of MITRE ATT&CK, threat detection, SOC operations, and incident response; experience with Microsoft Defender XDR, Entra ID, and Azure Security Services.
• PowerShell and Python scripting; strong analytical, troubleshooting, and stakeholder management skills.
• Bachelor’s degree in Computer Science, Information Security, Engineering, or a related discipline.

Preferred skills and certifications

• Preferred: SIEM migration, especially QRadar to Sentinel; banking or financial services; 24x7 SOC; regulatory standards; threat intelligence and endpoint platform integration.
• Preferred: Terraform, ARM, or Bicep; CI/CD pipelines for detection content.
• Preferred certifications include Microsoft SC-200, IBM QRadar certifications, CISSP, and GIAC GCIA, GCIH, or GCDA.