SIEM Engineer

Purpose

To build, operate and extend the security information and event management subsystem in line with the architect’s design; onboarding log sources, developing and tuning detection rules, maintaining the OpenSearch estate, and supporting the eventual handover of security operations to the client.

Key responsibilities

• Onboard log sources across the platform estate — subsystems, infrastructure, databases, the API gateway, the authorization service and field device telemetry — including decoder and parser development where sources are not natively supported.
• Normalise events into the common security schema so that detections apply consistently across sources.
• Develop, deploy and tune detection rules; investigate and reduce false positives; maintain the use case catalogue.
• Maintain the Wazuh and OpenSearch estate: agent deployment and health, cluster health, index lifecycle management, retention enforcement and capacity monitoring.
• Build and maintain security operations dashboards and reporting, including the audit and compliance reports required by the client.
• Support alert triage and incident investigation, and maintain the evidence handling procedure.
• Package subsystem configuration and rule sets as versioned artefacts for deployment by the integration team.
• Produce and maintain runbooks, and support training and handover to the client security function.

Essential experience

• Three or more years hands-on with a SIEM platform in production. Wazuh preferred; Elastic Security, Splunk, QRadar or equivalent acceptable with demonstrable transferable skills.
• OpenSearch or Elasticsearch operations — indices, mappings, index lifecycle management and query performance.
• Log parsing and normalisation — decoder, parser or pipeline development against sources with no native integration.
• Detection rule development and tuning, with practical experience of false positive reduction.
• Working knowledge of common attack techniques and how they present in log data.
• Linux administration and scripting in Python or Bash.

Desirable experience

• Portable detection rule formats and mapping to a recognised adversary technique framework.
• Kubernetes and Helm, sufficient to package configuration for handoff.
• Security monitoring of identity or payments platforms.
• Database and application audit logging, including PostgreSQL.
• A recognised security operations or blue team certification.

Expected hours: 40.0 – 45.0 per week

Application Question(s):

• Have you delivered software into a multi-party programme, where the organisation deploying it was not the one building it?
• Have you delivered production work in an on-premise or hybrid environment (not cloud-only)?

Experience:

• On-premises: 4 years (Required)

Work Location: In person