SIEM Management

We are seeking a Senior SIEM Engineer responsible for designing, implementing, and managing SIEM solutions to enhance security monitoring, threat detection, and incident response capabilities. The ideal candidate will have strong expertise in SIEM platforms such as Splunk, Microsoft Sentinel, or similar technologies, with experience in security integrations, log management, detection engineering, and SOC operations. The role will focus on optimizing SIEM capabilities, supporting security improvements, and collaborating with stakeholders to strengthen overall security posture.

Responsibilities

• Designing, reviewing, implementing, testing, maintaining, and troubleshooting SIEM deployments and infrastructures.
• Managing arrangements of dependencies and prerequisites for SIEM projects e.g., connectivity, storage, licenses, and other equipment.
• Implementing changes to the SIEM infrastructure (including patches, updates, and upgrades) and performing SIEM Health Checks; creating technically relevant detailed reports to track solution effectiveness and performance.
• Managing SIEM Appliance or Virtual Appliance (including OS and SIEM software).
• Configuring backups, verifying custom reports, managing log source groups, and validating log sources.
• Managing SIEM user accounts (create, delete, modify, etc.).
• Adding/removing log sources, troubleshooting issues with log sources or systems with system owners and vendors, and reporting system defects and product enhancement/feature requests with vendors as needed.
• Developing integrations, connectors, and parsers for new event sources.
• Implementing security monitoring rules in a SIEM tooling, according to the business needs.
• Assisting with fully optimizing the SIEM system capabilities and identifying opportunities for automation to improve SIEM effectiveness and efficiency.
• Creating rules and reports for compliance and audit requirements and managing Watch Lists for current threats.
• Creating engineering and security documentation for internal and external needs including high level and low-level design of SIEM infrastructure, as-built documentation and documentation for custom connectors/parsers and integrations.
• Assisting with designing and documenting work processes within the SOC.
• Mentoring and training Junior SIEM Engineers.
• Performing other duties as assigned.

Qualifications

Total Experience

• A minimum of 5 years of experience in Security Engineering, with at least 3 years of experience managing SIEM solutions.

Required Skills

• Proven experience in designing and implementing SIEM solutions.
• Proven experience in integrating security tools such as AV, AAA, Firewall, DLP, and IDS/IPS into SIEM solutions.
• Proven experience in implementing SIEM monitoring with cloud systems, including:
  • AWS CloudTrail
  • AWS GuardDuty
  • AWS VPC Flow Logs
  • Azure Activity Logs
  • Azure AD/Entra ID Sign-in Logs
  • Microsoft Defender for Cloud
  • GCP Cloud Audit Logs
  • GCP VPC Flow Logs
  • OCI Audit Logs
  • OCI Cloud Guard
• Proven experience with SIEM technologies such as Splunk, Microsoft Sentinel, Google SecOps, etc.
• Demonstrated understanding of Information Security regulations, frameworks, and requirements, with the ability to map a client’s security needs to an appropriate SIEM solution.
• Solid understanding of Information Security and Networking.
• Proven experience with scripting/query languages relevant to SIEM data onboarding, such as Python, Regex, SPL, and KQL.
• Outstanding time management and organizational skills.
• Ability to work on-call, including nights and weekends, as required.
• Proven capability to learn quickly and deliver to a high standard within deadlines.
• Strong organizational skills with the ability to prioritize tasks from multiple stakeholders.
• Excellent written and verbal communication skills.
• Ability to relay complex technical subject matter to non-technical stakeholders.
• Demonstrable analytical and technical aptitude, with a focus on identifying and addressing the root cause of problems.
• Proven ability to thrive and respond to frequent demands from multiple internal and external stakeholders in a high-demand, customer-centric environment.

Educational Qualifications

• Relevant Bachelor’s Degree

Desirable

• Familiarity with and experience working within the region.
• Experience working as part of an MSSP or MDR provider.
• Experience with deploying and administering multiple SIEM technologies.
• Certification in Splunk, Microsoft Sentinel, Google SecOps, or any other relevant SIEM technology, particularly in management and administration.