Security Engineer (SIEM & SOAR)

What You'll Do

SIEM Engineering

• Design, implement, and optimize SIEM solutions such as Splunk, Microsoft Sentinel, Google

SecOps, QRadar, and Elastic.

• Develop and enhance correlation rules, dashboards, alerts, and reports to improve threat visibility.
• Integrate security telemetry from cloud, endpoints, networks, and applications.
• Improve data ingestion, normalization, and parsing to increase detection accuracy and reduce

noise.

SOAR & Security Automation

• Build and maintain automated incident response playbooks using platforms such as Cortex XSOAR,

Splunk SOAR, or IBM Resilient.

• Automate alert triage, threat intelligence enrichment, and response actions.
• Partner with SOC analysts and threat hunters to streamline investigations and reduce response

times.

• Integrate SOAR platforms with ticketing systems, threat feeds, and security controls.

Security Operations Support

• Support incident response through actionable detections and automation-driven insights.
• Perform root cause analysis and develop engineering solutions to address recurring threats.
• Collaborate with compliance and audit teams to strengthen security controls.
• Create documentation and provide enablement sessions for SOC and IT teams.

Required Experience

What We're Looking For

• 3–8 years of cybersecurity experience, with strong hands-on experience in SIEM and/or SOAR

engineering.

• Experience working in a Security Operations Center (SOC) environment is highly preferred.
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.

Technical Skills

• Hands-on experience with at least one SIEM platform:
• Splunk
• Microsoft Sentinel
• Google SecOps
• QRadar
• ArcSight
• Experience developing SOAR playbooks, workflows, and security automations.
• Scripting and automation skills using Python, PowerShell, or Bash.
• Knowledge of MITRE ATT&CK, NIST, CIS Controls, or similar cybersecurity frameworks.
• Familiarity with EDR/XDR, IDS/IPS, firewall technologies, and cloud security (AWS, Azure, or GCP).