Senior Security Operations Engineer; SIEM​/SOAR); m​/f​/d

We are seeking an experienced Senior Security Operations Engineer (SIEM / SOAR) to lead the design, implementation, and optimization of enterprise security monitoring and automation capabilities within a highly regulated environment.

This role will be responsible for engineering and managing Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) platforms while supporting enterprise-scale security monitoring, threat detection, and incident response initiatives. The successful candidate will play a critical role in enhancing security visibility, automating response workflows, and ensuring monitoring controls remain effective, resilient, and audit-ready.

The ideal candidate will possess strong expertise in IBM QRadar, Microsoft Sentinel, SIEM Engineering, SOAR Automation, Detection Engineering, Threat Monitoring, and Security Operations
, with experience working in large-scale Security Operations Centers (SOC) and regulated environments.

• Design, implement, and maintain enterprise SIEM platforms including IBM QRadar and Microsoft Sentinel.
• Manage log onboarding, parsing, normalization, and monitoring across infrastructure, cloud, identity, application, database, and endpoint environments.
• Design scalable SIEM architectures, including data retention, workspace design, performance optimization, and capacity planning.
• Monitor platform health and ensure continuous log collection visibility across all critical sources.
• Manage SIEM upgrades, lifecycle management, platform maintenance, and optimization activities.

• Support or lead SIEM transformation and migration initiatives, including QRadar to Microsoft Sentinel migrations.
• Translate existing detection content into modern cloud-native detection capabilities.
• Ensure continuity of security monitoring, detection coverage, and historical log access during platform transitions.

• Develop, tune, and maintain security detections aligned with threat intelligence and the MITRE ATT&CK framework.
• Build and improve use cases focused on cyber threats impacting financial services and enterprise environments.
• Continuously optimize detection logic to improve alert fidelity and reduce false positives.

• Design and implement security automation workflows and SOAR playbooks.
• Automate enrichment, investigation, triage, containment, notification, and response activities.
• Integrate SIEM and SOAR platforms with EDR, threat intelligence, identity platforms, and ITSM solutions.

• Support SOC analysts and incident response teams during major security events.
• Develop and maintain technical documentation, architecture diagrams, runbooks, and operational procedures.
• Support audits, regulatory reviews, and compliance assessments with evidence of control effectiveness.
• Track and report platform performance, coverage metrics, and operational effectiveness.

• 5-10 years of experience in Security Operations, SIEM Engineering, Detection Engineering, or Cybersecurity Operations.

• Proven expertise in:

  • IBM QRadar
  • Microsoft Sentinel
  • SIEM Engineering
  • SOAR Automation
  • Detection Engineering
  • Security Monitoring

• Strong hands-on experience with:

  • KQL (Kusto Query Language)
  • AQL
  • Microsoft Sentinel Analytics Rules
  • QRadar Rule Development
  • Log Parsing & Normalization

• Experience with:

  • Syslog
  • CEF
  • APIs
  • Azure Monitor Agent (AMA)
  • Data Collection Rules (DCRs)

• Strong understanding of:

  • MITRE ATT&CK
  • Threat Detection Methodologies
  • SOC Operations
  • Incident Response Processes

• Experience working with:

  • Microsoft Defender XDR
  • Microsoft Entra
  • Azure Security Services

• Scripting experience in:

  • Power Shell
  • Python

• Excellent analytical, troubleshooting, and stakeholder management skills.

• Experience delivering SIEM migrations, particularly QRadar to Microsoft Sentinel.
• Banking or financial services industry experience.
• Experience supporting 24x7 Security Operations Centres.
• Knowledge of regulatory standards including PCI DSS and banking security frameworks.
• Experience integrating threat intelligence and endpoint security platforms.
• Familiarity with Infrastructure as Code (Terraform, ARM, Bicep).
• Experience implementing CI/CD pipelines for detection content and security engineering.

• Microsoft Certified:
  Security Operations Analyst Associate (SC-200)
• IBM QRadar…