SIEM Architect

Purpose

To own the design of the security information and event management subsystem — a contracted platform deliverable built on Wazuh over OpenSearch. The role covers the security data model, detection engineering, log-source onboarding across the platform estate, retention and evidential integrity, and the design of the security operations model, which is ultimately handed to the client.

Key responsibilities

• Define the SIEM architecture: Wazuh manager and agent topology, OpenSearch cluster design, indexing and sharding strategy, index lifecycle management across hot, warm and cold tiers, and capacity planning for the full platform log volume.
• Establish the security data model—event normalisation, field mapping, and a common schema across heterogeneous sources — so detections are written once rather than per source.
• Own log-source onboarding across the estate: platform subsystems, the identity core, infrastructure, databases, the API gateway, the authorisation service and field-device telemetry. Produce the onboarding standard that subsystem teams follow.
• Build the detection engineering capability — use-case catalogue, rule development and tuning methodology, mapping to a recognised adversary technique framework, and a defined process for measuring and reducing false positives.
• Define alert triage, severity classification, escalation paths and incident response workflow.
• Design retention, immutability and access control for security data, on the basis that it is subject to stricter requirements than operational logging and may be relied on as evidence.
• Define audit and compliance reporting for the client, including the reports required at acceptance and during steady-state operation.
• Design the security operations model and the handover path to the client security function, including the training and documentation required for them to operate it.
• Package the subsystem as parameterised Helm charts with externalised configuration for deployment by the integration team.
• Produce operational runbooks covering cluster health, agent management, rule deployment, incident response and evidence handling.
• Develop the SIEM Engineer to independent capability.

Essential experience

• SIEM designed and operated in production at enterprise or national scale. Wazuh preferred; equivalent depth in Elastic Security, Splunk, QRadar or Sentinel is acceptable where the candidate can demonstrate transferable reasoning to Wazuh and OpenSearch.
• OpenSearch or Elasticsearch cluster operations — index lifecycle management, shard and replica strategy, retention design, and capacity planning for sustained ingest volume.
• Detection engineering: rule development, tuning methodology, and a demonstrable approach to reducing false positives. Candidates who have only consumed vendor rule packs are not suited to this role.
• Log source onboarding across heterogeneous estates, including normalisation into a common schema.
• Design of a security operations model, and experience handing one over to another organisation to run.
• On-premise deployment. Managed cloud SIEM services do not substitute.

Desirable experience

• Mapping detections to a recognised adversary technique framework, and portable rule formats.
• Government, national infrastructure or regulated environments with evidential retention requirements.
• Security monitoring of identity platforms — authentication and authorisation events, certificate and device trust telemetry, privileged access.
• Kafka as a log transport tier.
• Data protection and information security management standards relevant to a government client.

Expected hours: 40.0 – 45.0 per week

Application Question(s):

• Have you delivered software into a multi-party programme, where the organisation deploying it was not the one building it?
• Have you delivered production work in an on-premise or hybrid environment (not cloud-only)?
• Are you comfortable working within a settled technology

decision rather than proposing a consolidated platform?

Experience:

• On-premises: 6 years (Required)

Work Location: In person