SIEM /SOAR Platform Engineer

Roles & Responsibilities

SIEM Platform Engineering

• Design, deploy, configure, and maintain Microsoft Sentinel and SentinelOne Singularity SIEM/Security platforms.
• Manage and troubleshoot log collectors, connectors, agents, data ingestion pipelines, and log forwarding mechanisms.
• Develop, customize, and optimize parsers, data normalization, and log parsing configurations.
• Onboard new security assets, applications, infrastructure, and data sources into the SIEM platform.
• Identify and resolve challenges related to existing asset integrations, missing logs, parsing issues, and data quality.
• Perform POCs and feasibility assessments for onboarding new security technologies and log sources.
• Ensure proper log visibility, data completeness, field mapping, normalization, and ingestion quality.

Asset Onboarding & Integrations

• Lead end-to-end onboarding of new assets and technologies into the SIEM/SOAR platforms.
• Integrate security solutions across:
• Cloud Security
• Network Security
• Endpoint Security
• Data Security
• Email Security
• Identity and Access Management
• Vulnerability Management
• Application and Web Security
• Threat Intelligence Platforms
• Other cybersecurity solutions and custom applications
• Work with vendors and internal teams to resolve integration and compatibility issues.
• Develop and validate custom integrations using APIs, syslog, REST APIs, webhooks, agents, connectors, and other supported integration methods.

Automation & SOAR Engineering

• Design and implement automation rules and automation policies.
• Develop and maintain SOAR playbooks for automated incident response and remediation.
• Build use cases for alert enrichment, investigation, ticket creation, notification, containment, and remediation.
• Integrate SIEM/SOAR platforms with external security tools and enterprise applications.
• Develop automated workflows to reduce SOC manual effort and improve incident response time.
• Continuously optimize existing automation and SOAR playbooks based on operational requirements.

Troubleshooting & Optimization

• Troubleshoot complex issues related to:
• Log collection and ingestion
• Parser failures and data mapping
• Asset onboarding
• Connectors and integrations
• APIs and authentication
• Automation and playbook failures
• Data visibility and quality
• Perform root cause analysis and implement permanent fixes.
• Optimize SIEM performance, log ingestion, storage, and operational efficiency.

Collaboration & Documentation

• Work closely with SOC analysts, security architects, infrastructure teams, cloud teams, and third-party vendors.
• Create and maintain technical documentation for integrations, onboarding procedures, parsers, playbooks, and operational processes.
• Provide technical guidance and support to SOC teams on SIEM and SOAR capabilities.
• Stay updated with the latest Microsoft Sentinel, SentinelOne, cloud security, and cybersecurity integration capabilities.

Required Technical Skills

• Strong hands-on experience with Microsoft Sentinel.
• Strong experience with SentinelOne Singularity platform, particularly SIEM, security data ingestion, integrations, and automation capabilities.
• Experience with SIEM architecture, log management, log ingestion, parsing, normalization, and troubleshooting.
• Experience developing and troubleshooting SIEM parsers and custom log integrations.
• Experience with Microsoft Sentinel Data Connectors, Analytics Rules, Automation Rules, and Logic Apps.
• Experience designing and developing SOAR playbooks and automated response workflows.
• Strong knowledge of REST APIs, JSON, webhooks, Syslog, CEF, and other security log formats.
• Scripting knowledge in Python, PowerShell, or similar scripting languages.
• Experience integrating cybersecurity solutions across cloud, network, endpoint, data, and email security domains.

Preferred Skills

• Microsoft Sentinel and SentinelOne technical certifications.
• Experience with Microsoft Azure security services and Azure Logic Apps.
• Knowledge of MITRE ATT&CK framework and security incident lifecycle.
• Experience with API-based and custom SIEM integrations.
• Experience working with SOC, Managed Security Services, or enterprise security environments.
• Knowledge of detection engineering and threat use cases.