Sr IT Security Analyst SIEM SOAR

Roles and Responsibilities

• Architect, implement, and maintain SIEM infrastructure to ensure reliable log ingestion, parsing, correlation, and alerting across enterprise systems.
• Develop and fine-tune detection content and analytics rules to identify suspicious or malicious activity across endpoints, networks, and cloud environments.
• Manage and enhance Network Detection and Response (NDR) and Extended Detection and Response (XDR) platforms, integrating telemetry for end-to-end visibility.
• Partner with the SOC and Incident Response teams to improve alert fidelity, reduce false positives, and accelerate investigation workflows.
• Integrate SIEM with SOAR and automation pipelines to support rapid response and consistent case handling.
• Collaborate with infrastructure and application teams to ensure comprehensive log coverage and compliance with data retention and privacy requirements.
• Develop and maintain dashboards, metrics, and reporting to measure detection performance and operational efficiency.
• Conduct periodic health checks, tuning, and performance optimization for SIEM and NDR solutions.
• Maintain detailed documentation, playbooks, and SOPs supporting SIEM and NDR operations.

Skills and Qualifications

Required:

• 58 years of experience in security engineering, detection engineering, or SOC architecture in an enterprise environment.
• Expert-level knowledge of SIEM platforms (e.g., Splunk, XSOAR, or equivalent), including onboarding, parsing, rule creation, and optimization.
• Strong understanding of detection engineering, including attack chain mapping, MITRE ATT&CK coverage, and event correlation.
• Experience with log source onboarding (firewalls, proxies, endpoints, cloud, identity, email systems etc.).
• Familiarity with SOAR tools and automation workflows for triage and enrichment.
• Strong scripting skills (Python, PowerShell, or Bash) for rule automation, parsing, and enrichment.
• Understanding of cloud detection engineering across Azure, AWS, or GCP environments.
• Excellent analytical, problem-solving, and communication skills, with a focus on collaboration and data-driven decision-making.
• SIEM engineering and administration (Splunk, Sentinel, etc.)
• Log collection, parsing, and correlation logic development
• NDR/XDR deployment and tuning (e.g., ExtraHop, Vectra, Cisco, CrowdStrike, or similar)
• Detection engineering and content lifecycle management
• Cloud detection coverage (Azure, AWS, GCP)
• Scripting and automation (Python, PowerShell, Bash)
• SOAR integration for alert enrichment and response automation
• Data normalization, threat hunting, and query development
• Familiarity with the MITRE ATT&CK and D3FEND frameworks
• Network security, endpoint telemetry, and identity-based detection techniques

Preferred:

• Bachelor’s degree in Cybersecurity, Computer Science, or related technical field, or equivalent professional experience.
• Demonstrated success designing, scaling, and maintaining enterprise SIEM and detection systems.
• Certifications such as GIAC Certified Detection Analyst (GCDA), GIAC Security Operations Certified (GSOC), CompTIA CySA+, ISC2 SSCP, Splunk Enterprise Security Certified Admin or Architect, or equivalent detection engineering or SIEM certification
• Analytical and detail-oriented with a focus on precision and reliability
• Strong communication and collaboration across technical and non-technical stakeholders
• Adaptable and proactive in a fast-paced, global environment
• Passion for continuous learning, innovation, and automation in security operations
• Effective mentor and team contributor