Security Engineer

My Client is seeking a hands-on Security Engineer to own and optimise SIEM rules, alert tuning and log aggregation, primarily within IBM QRadar. The role will focus on improving threat detection and ensuring high-quality security logs are available to a third-party SOC. There may also be an opportunity to support a future migration to Splunk.

• Own, maintain and tune IBM QRadar SIEM rules, correlation logic and alerts.
• Review and optimise detection use cases to improve threat visibility and reduce false positives.
• Configure and maintain log collection, parsing, normalisation and aggregation.
• Support log aggregation using Fluentd, Cribl or similar technologies.
• Ensure relevant security logs are accurately ingested and available to the third-party SOC.
• Troubleshoot log ingestion, parsing and SIEM detection issues.
• Identify opportunities to improve SIEM coverage, logging quality and detection capabilities.
• Support planning and potential migration from QRadar to Splunk.

• Strong hands-on experience with IBM QRadar SIEM.
• Experience developing, maintaining and tuning SIEM rules and correlation searches.
• Good understanding of security logging, log sources and event normalisation.
• Experience with log aggregation and forwarding technologies.
• Experience working with SOC teams and supporting security monitoring operations.

• Experience with Fluentd, Cribl or Fluent Bit.
• Exposure to Splunk SIEM and migration projects.
• Scripting experience using Python, Bash or similar.
• Experience onboarding new log sources and troubleshooting ingestion pipelines.

The Security Engineer is required 1 day a week onsite in Central London.