Principal Cyber Security Engineer

Ally Financial is seeking a Principal Cyber Security Engineer to lead the SIEM platform lifecycle from design through ongoing optimization. This onsite role in Detroit partners closely with the SOC, incident response, threat hunting, IT operations, and application teams to deliver reliable, compliant log management and actionable detections.

You will own key aspects of SIEM architecture and operations, including data ingestion pipelines, parsing and normalization, storage and retention strategy, and platform performance tuning. The position also focuses on measurable detection outcomes using KPIs and KRIs, while ensuring the SIEM data handling aligns with applicable regulatory and contractual requirements.

• Design and maintain the SIEM architecture
  , including data ingestion pipelines, parsers, normalization schemas, storage tiers, and retention strategies.
• Evaluate and implement SIEM platform features and integrations, and drive upgrades and migrations as needed.
• Onboard logs from diverse sources such as EDR
  , firewalls, IDS/IPS, IAM, AD, DNS, proxies, email security, cloud platforms (AWS/Azure/GCP), SaaS apps, containers/Kubernetes, and databases, as well as identity providers.
• Implement data quality monitoring and SLA-driven dashboards for ingestion health, parser accuracy, and data latency.
• Optimize SIEM performance across indexing and search speed, hot/warm/cold storage, retention, and cost control.
• Implement role-based access control
  , multitenancy (if applicable), and data governance.
• Ensure high availability and disaster recovery
  ; document and test failover procedures.
• Define KPIs/KRIs such as MTTD, alert quality, data freshness, coverage, and false positive rate.
• Run purple-team exercises and detection gap assessments, and drive remediation work.
• Provide runbooks, knowledge base articles, and training to SOC and IT teams.
• Align SIEM data handling with regulatory and contractual requirements including SOC 2, ISO 27001, PCI-DSS, HIPAA, and GDPR
  ; support audits and eDiscovery.
• Implement data minimization, masking, and retention policies.
• Partner with IT, Cloud, and Data teams to implement logging at the source and ensure secure, reliable transport.
• Contribute to security architecture reviews for new systems and applications.

• 5+ years of experience in SIEM engineering or closely related security engineering roles.
• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent experience.
• Proven end-to-end expertise with at least one enterprise SIEM platform, preferably Splunk and Cribl (e.g., Splunk, Microsoft Sentinel, QRadar, Elastic Security, Exabeam, Sumo Logic, Log Rhythm, Chronicle).
• Strong proficiency in data parsing and normalization (e.g., regex, grok, KQL, SPL, AQL, Lucene).
• Strong proficiency in detection rule creation, correlation logic, and tuning.
• Strong proficiency in scripting/automation (e.g., Python, Power Shell, REST APIs, Terraform/Ansible preferred).
• Hands-on experience onboarding logs from Windows/Linux, AD, network devices, cloud services, EDR, and SaaS.
• Hands-on experience integrating SIEM with SOAR
  , ticketing (Service Now, JIRA), and case management.
• Good understanding of security operations, incident response workflows, and threat detection frameworks (MITRE ATT&CK, NIST 800-61).
• Experience with public cloud platforms (AWS, Azure, etc.).
• Experience with cloud logging and security services (AWS Cloud Trail/Cloud Watch/Guard Duty, Azure Defender/M365, GCP Audit Logs).
• Knowledge of data pipelines and messaging (Kafka, Kinesis, Event Hubs) and storage tiers (object storage, hot/warm/cold).
• Experience with Agile methodologies and collaborative work environments.
• Familiarity with identity and access management,…