SIEM Engineer

Role Overview

Key Responsibilities

• Design, implement, maintain, and troubleshoot SIEM infrastructure and deployments; manage Splunk, Microsoft Sentinel, or Google SecOps.
• Integrate firewalls, antivirus, AAA, DLP, IDS/IPS, and other security tools; onboard and manage log sources, connectors, parsers, and custom integrations.
• Develop and maintain monitoring rules, alerts, reports, watchlists, and compliance use cases; monitor cloud logs across AWS, Azure, GCP, and OCI.
• Perform SIEM health checks, upgrades, patching, backups, optimization, and troubleshooting.
• Develop queries and scripts using SPL, KQL, Python, and Regex; prepare technical designs, documentation, health reports, and solution deliverables.
• Support SOC processes, automation, and continuous improvement; mentor junior engineers and work with teams, clients, and vendors.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field.
• 5+ years of Security Engineering experience, including at least 3 years of hands-on SIEM experience.
• Strong knowledge of information security, networking, security monitoring, and relevant frameworks.
• Hands-on experience with at least one major SIEM platform: Splunk, Microsoft Sentinel, or Google SecOps.
• Strong SIEM architecture, implementation, administration, integration, and log-management experience; experience with cloud security monitoring and cloud-native logs.
• Strong analytical, troubleshooting, communication, and stakeholder-management skills; ability to participate in on-call coverage, including nights or weekends when required.

Preferred Qualifications

• MSSP/MDR and regional experience; experience managing multiple SIEM technologies.
• Relevant certifications for Splunk, Microsoft Sentinel, or Google SecOps.
• Experience with SIEM automation, custom parsers, connectors, and security use-case development.