Cyber Security Engineer

PURPOSE OF THE JOB/PROJECT

We are seeking a highly skilled Senior Cyber Security Engineer (SIEM) to join our security engineering team. The ideal candidate will be responsible for designing, implementing, optimizing, and maintaining enterprise SIEM solutions to ensure robust security monitoring and threat detection capabilities. This role involves working with leading technologies such as Splunk, Cribl, Microsoft Sentinel, and CrowdStrike , enabling the organization to proactively detect anomalies, respond to incidents, and enhance overall cyber resilience.

Key Responsibilities

SIEM Engineering & Administration

• Architect, deploy, configure, and maintain SIEM platforms including Splunk, Cribl, and Microsoft Sentinel .
• Manage ingestion pipelines, data onboarding, parsing, normalization, and log source integration.
• Develop and optimize dashboards, search queries, alerts, and correlation rules to enhance threat detection and operational visibility.
• Ensure high availability, performance tuning, and scalability of SIEM solutions.

Threat Detection & Use Case Development

• Build and maintain advanced detection content aligned with threat intelligence and MITRE ATT&CK.
• Perform continuous improvement of detection logic to reduce false positives and improve detection fidelity.
• Collaborate with Incident Response teams to refine rules and support investigations.

Security Tools Integration

• Integrate SIEM solutions with security tools such as CrowdStrike , firewalls, EDR, identity platforms, cloud workloads, and network security devices.
• Implement log forwarding, routing, and transformation pipelines using Cribl .

Governance, Monitoring & Compliance

• Ensure logging compliance for regulatory and policy requirements (ISO 27001, SOC 2, NIST, etc.).
• Conduct periodic audits of data ingestion, retention policies, and access controls.

Cross‑Functional Collaboration

• Work closely with SOC analysts, threat hunters, cloud engineers, and infrastructure teams.
• Provide subject‑matter expertise for SIEM-related projects, architecture enhancements, and security initiatives.

Required Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or equivalent experience.
• 5+ years of experience in cybersecurity with strong SIEM engineering focus.
• Proven hands-on expertise with:
• Splunk Enterprise / Splunk Enterprise Security
• Cribl Stream / Cribl Edge
• Microsoft Sentinel
• CrowdStrike Falcon (EDR, telemetry integration)
• Strong knowledge of log management, data pipelines, detection engineering, and security analytics.
• Proficiency in query languages (e.g., SPL, KQL).
• Deep understanding of security frameworks, incident response, and threat detection methodologies.

Preferred Qualifications

• Certifications such as Splunk Power User / Admin, GIAC GCIA/GCIH, Azure Security Engineer (AZ-500), CrowdStrike certifications, or equivalent.
• Experience with automation and scripting (Python, PowerShell, Bash).
• Familiarity with cloud environments (Azure, AWS, GCP) and cloud logging architecture.
• Experience in threat hunting and advanced detection tuning.