SIEM Engineer

Siem engineer – job description role overview the siem engineer is responsible for designing, implementing, maintaining, and optimizing the organization's security information and event management (siem) platform. This role supports security operations by developing detection use cases, integrating log sources, improving threat visibility, and enhancing incident response capabilities across on-premises, cloud, and hybrid environments. The siem engineer works closely with soc analysts, incident responders, threat intelligence teams, infrastructure teams, and security leadership to strengthen the organization's cyber defense posture.key

responsibilities siem administration & engineeringmanage and maintain enterprise siem platforms.configure and optimize log ingestion, normalization, parsing, and retention.integrate security data sources including:firewallsids/ipsedr/xdractive directory / entra idcloud platforms (azure, aws, gcp) network and endpoint security solutions ensure availability, scalability, and performance of siem infrastructure. Detection engineering & use case development develop and maintain correlation rules, analytics, and detection content.create use cases aligned with mitre att&ck techniques.tune

detection rules to reduce false positives and improve alert fidelity.work with purple team, red team, and threat intelligence teams to improve detection coverage.implement new monitoring capabilities for emerging threats. Security monitoring & incident supportsupport soc operations through advanced threat detection and alert analysis.assist incident responders during investigations.correlate events across multiple technologies to identify malicious activity.perform root cause analysis and recommend containment improvements.develop

dashboards and reporting for operational visibility. Threat hunting & threat intelligence integrationdevelop hunting queries to identify malicious behavior not detected by automated alerts.integrate threat intelligence feeds into the siem platform.create indicators of compromise (ioc) monitoring and enrichment processes.identify suspicious trends and emerging attack patterns. Automation & optimizationautomate siem administration and monitoring tasks using scripting.integrate siem with soar platforms and ticketing systems.develop

workflows for alert enrichment, escalation, and incident response.improve operational efficiency through automation and orchestration. Governance, compliance & reporting support regulatory and audit requirements.maintain siem documentation, runbooks, and standards.produce security metrics and executive reporting.ensure log retention and monitoring practices meet compliance requirements.required qualificationsexperience5+ years of cybersecurity experience.
3+ years managing and engineering siem platforms.experience supporting soc operations and incident response.experience in financial services or regulated industries preferred.technical skills expertise in platforms such as:microsoft sentinelsplunkqradarlogrhythmelastic securitycrowdstrike ng-siemcriblstrong knowledge of:windows and linux security logsnetwork security monitoringedr/xdr technologiesthreat hunting methodologiesmitre att&ck frameworkdata ingestion pipelines scripting experience:kqlpowershellpythonsqlsecurity knowledgelog management and event correlation.detection engineering.threat intelligence.incident response processes.vulnerability management concepts.zero trust security principles.preferred certificationsmicrosoft certified: security operations analyst (sc-200) microsoft sentinel specialtysplunk enterprise security certified admingiac certified incident handler (gcih) giac certified intrusion analyst (gcia) cissp compensation the expected annual salary for this…