SIEM Engineer

Key Skills: Admin, Implementation, Splunk, Security Engineering, Deployment, Alert monitoring, SIME Log scale

Roles and Responsibilities:

• Administer and support the enterprise SIEM platform, preferably Splunk Enterprise/Splunk Cloud, ensuring platform availability, operational health, and effective security monitoring.
• Onboard and integrate logs from enterprise firewalls, network devices, servers, operating systems, endpoint security platforms, identity providers, cloud services, applications, and security tools.
• Configure and maintain log collection, forwarding, parsing, field extraction, normalization, timestamp handling, and source categorization to ensure accurate and consistent log ingestion.
• Develop, maintain, and optimize Splunk searches, correlation rules, alerts, dashboards, reports, and visualizations to support security monitoring and threat detection.
• Monitor SIEM ingestion health, identify missing or delayed logs, investigate ingestion failures, and coordinate with respective technology teams to restore log visibility.
• Develop and maintain use cases for detecting suspicious activities, unauthorized access, privilege escalation, malware indicators, anomalous network traffic, data exfiltration, and other potential security threats.
• Investigate security alerts by correlating events across multiple log sources, identifying indicators of compromise, and providing actionable findings to the Security Operations and Incident Response teams.
• Perform initial triage and analysis of security events, distinguish potential threats from false positives, and escalate confirmed or high-risk incidents in accordance with established procedures.
• Create and tune detection rules, correlation searches, thresholds, and alert conditions to improve detection accuracy and reduce false positives.
• Support Splunk architecture and data onboarding components, including forwarders, heavy forwarders, parsing configurations, source types, indexes, data inputs, and routing configurations, as applicable to the deployment.
• Monitor data ingestion volumes, license or workload utilization, search performance, and retention requirements; identify optimization opportunities and support capacity planning.
• Support log retention, archival, and availability requirements in accordance with organizational policies, audit obligations, and security monitoring needs.
• Integrate SIEM with threat intelligence feeds, endpoint detection and response (EDR), firewalls, identity and access management solutions, vulnerability management platforms, and other relevant security technologies.
• Support incident investigations by preparing event timelines, reviewing authentication and network activity, correlating security events, and documenting findings and recommended actions.
• Develop operational dashboards and periodic reports covering log source coverage, ingestion health, alert volumes, security events, detection effectiveness, and platform performance.
• Collaborate with Network & Security Engineering, Cloud, Infrastructure, Endpoint Security, Application Support, and Cyber Security teams to resolve logging gaps and improve enterprise-wide security visibility.
• Support the onboarding of new applications, infrastructure components, and security technologies into the SIEM platform by defining logging requirements and validating data quality.
• Participate in security incident management, problem management, change implementation, root cause analysis, and continuous service improvement initiatives.
• Maintain SIEM documentation, log source inventories, onboarding checklists, detection use-case documentation, operational procedures, troubleshooting guides, and incident investigation records.
• Ensure adherence to ITSM processes, including incident, problem, change, and service request management, along with applicable security standards and governance requirements.
• Evaluate new SIEM capabilities, conduct technical assessments and proofs of concept, and recommend improvements to strengthen detection coverage, operational efficiency, and security posture.
• Qualifications

Skills Required:

• 2-3 years of hands-on experience in SIEM administration, security monitoring, log management, or security engineering.
• Strong working knowledge of Splunk Enterprise and/or Splunk Cloud Splunk experience is strongly preferred.
• Experience with SPL (Search Processing Language), including search queries, field extraction, data filtering, aggregation, statistical analysis, and correlation searches.
• Hands-on experience with SIEM dashboards, alerts, scheduled searches, reports, data models, and detection use cases.
• Understanding of SIEM architecture, log collection, ingestion pipelines, parsing, normalization, indexing, search, and data retention.
• Experience onboarding and troubleshooting logs from firewalls, routers, switches, servers, Windows and Linux systems, endpoint security solutions, identity platforms, and cloud environments.
• Working knowledge of Splunk Universal Forwarders, Heavy Forwarders, inputs, outputs, indexes, source types, parsing configurations, and data routing is preferred.
• Understanding of common security log formats and protocols, including Syslog, JSON, CEF, LEEF, Windows Event Logs, and API-based log ingestion.
• Knowledge of security monitoring concepts, including authentication anomalies, privilege escalation, brute-force attempts, suspicious processes, malware activity, command-and-control communication, and data exfiltration.
• Familiarity with MITRE ATT&CK, common attack techniques, indicators of compromise (IOCs), and security event correlation.
• Experience in security alert triage, event correlation, incident investigation, false-positive analysis, and escalation procedures.
• Understanding of enterprise network and security technologies, including firewalls, VPNs, DNS, proxy/SWG, IDS/IPS, EDR, DLP, and identity and access management.
• Basic understanding of TCP/IP, DNS, HTTP/HTTPS, authentication protocols, and network traffic analysis to support security investigations.
• Experience integrating SIEM with security platforms, threat intelligence sources, vulnerability management tools, and incident response workflows.
• Understanding of log source coverage, ingestion monitoring, retention policies, data quality, and SIEM operational health.
• Familiarity with ITSM platforms such as ServiceNow and monitoring tools such as PRTG, SolarWinds, or equivalent is preferred.
• Knowledge of scripting or automation using Python, PowerShell, or shell scripting is an advantage.
• Exposure to SOAR, automated incident response, and security workflow automation is desirable.
• Strong analytical, problem-solving, documentation, communication, and cross-functional collaboration skills.

Education: Relevant certifications such as Splunk Core Certified User/Power User, Splunk Enterprise Certified Admin, or equivalent SIEM/security certifications are preferred.