SIEM Engineer

AMEXIO Luxembourg is looking for a SIEM Engineer to join a security team at one of our clients, a major player in the Luxembourg financial sector.

📍 Location: Luxembourg, full-time on-site

Your mission

You will make sure that security logs are complete, correctly parsed, normalised and reliable for detection, investigation and reporting.

• Monitor existing log sources and onboard new ones according to the logging roadmap
• Run log quality assurance: detect, document and escalate gaps, parsing defects and regressions
• Transform, filter, route and normalise event data across SIEM pipelines
• Maintain parsing specifications, mappings, runbooks and change traceability
• Prepare and peer-review production-ready changes
• Act as backup for Splunk infrastructure: health checks, forwarders, cluster status, licence and storage monitoring
• Test, tune and package Splunk use cases (alerts, reports, dashboards)

What you bring

• Outstanding Regular Expression skills and strong experience parsing semi-structured logs. This is the core of the role.
• Solid IT fundamentals: systems, networking, authentication, logging
• Scripting in at least one language (Python, PowerShell or Bash)
• Rigour, attention to detail and clear documentation habits
• Fluent English; French or Italian is a plus

Nice to have

• Hands-on Splunk/SPL experience, including knowledge objects and search-time troubleshooting
• Exposure to Splunk administration (Search Heads, Indexers, Forwarders, Deployer)
• Familiarity with the Splunk CIM and log loss/latency detection
• Splunk certifications (Core User, Power User, Enterprise Admin)

Good to know

Shortlisted candidates will complete a practical RegEx exercise as part of the selection proces