Senior Information Security Engineer - SIEM & SOC Tools

Our client, a leading online retailer, is looking for a highly skilled Senior Information Security Engineer with expertise in Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) tools. This is a fully remote position, allowing you to work from any location within South Africa. You will be responsible for the design, implementation, tuning, and maintenance of our client's SIEM and SOAR platforms, as well as other security monitoring tools.

Your role will be critical in enhancing the organization's ability to detect, investigate, and respond to security threats efficiently and effectively. The ideal candidate is proactive, technically adept, and passionate about leveraging technology to improve security operations.

• Design, deploy, configure, and maintain SIEM and SOAR platforms (e.g., Splunk, QRadar, Log Rhythm, Palo Alto Cortex XSOAR).
• Develop and optimize correlation rules, alerts, dashboards, and reports within the SIEM system.
• Integrate various security tools and log sources into the SIEM platform.
• Develop and automate security workflows and playbooks using the SOAR platform.
• Respond to and investigate complex security incidents escalated from the SOC.
• Perform threat hunting activities by leveraging SIEM data and other security tools.
• Provide expert technical guidance and support to SOC analysts and other security team members.
• Conduct performance tuning and capacity planning for SIEM and SOAR infrastructure.
• Stay current with the latest security threats, vulnerabilities, and security technologies.
• Document SIEM/SOAR configurations, rules, playbooks, and operational procedures.
• Collaborate with IT and development teams to ensure effective log collection and data normalization.

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
• Minimum of 5 years of experience in information security, with at least 3 years focused on SIEM administration, engineering, or SOC tool management.
• Proven experience in deploying, configuring, and managing enterprise-grade SIEM solutions.
• Hands-on experience with SOAR platforms and developing automation playbooks.
• Strong understanding of log analysis, threat detection techniques, and incident response processes.
• Proficiency in scripting languages such as Python, Power Shell, or Bash for automation.
• Experience with data ingestion, parsing, and normalization from various log sources.
• Solid understanding of networking, operating systems, and common security vulnerabilities.
• Excellent analytical, problem-solving, and troubleshooting skills.
• Strong communication and documentation skills.
• Relevant security certifications (e.g., Splunk Certified Administrator/Architect, GSEC, GCIH) are highly desirable.
• Experience with cloud-native security monitoring tools is a plus.

Our client offers a competitive salary, comprehensive health and retirement benefits, performance incentives, and excellent opportunities for professional development and certifications. This role offers the flexibility of working remotely from anywhere in South Africa.