Job Description

We are seeking a skilled professional for the role of Executive - SIEM Engineering, with 2-3 years of relevant experience in Security Information and Event Management, security monitoring, log management, and incident investigation within an enterprise environment.

The role requires hands-on expertise in SIEM platforms, preferably Splunk Cloud, with a strong understanding of security log onboarding, parsing, normalization, correlation searches, alert engineering, dashboards, threat detection, and security incident investigation. The candidate will be responsible for maintaining SIEM platform health, improving detection capabilities, ensuring log source coverage, and supporting security operations through actionable security insights.

The ideal candidate should have experience integrating logs from enterprise infrastructure, firewalls, endpoint security, identity platforms, cloud environments, network security solutions, and other critical systems. The candidate should possess strong analytical and troubleshooting skills, with the ability to investigate security events, optimize detection rules, and collaborate with Cyber Security, Infrastructure, Network & Security Engineering, and other technology teams to strengthen the organization's security monitoring and incident response capabilities.

• Administer and support the enterprise SIEM platform, preferably Splunk Enterprise/Splunk Cloud, ensuring platform availability, operational health, and effective security monitoring.
• Onboard and integrate logs from enterprise firewalls, network devices, servers, operating systems, endpoint security platforms, identity providers, cloud services, applications, and security tools.
• Configure and maintain log collection, forwarding, parsing, field extraction, normalization, timestamp handling, and source categorization to ensure accurate and consistent log ingestion.
• Develop, maintain, and optimize Splunk searches, correlation rules, alerts, dashboards, reports, and visualizations to support security monitoring and threat detection.
• Monitor SIEM ingestion health, identify missing or delayed logs, investigate ingestion failures, and coordinate with respective technology teams to restore log visibility.
• Develop and maintain use cases for detecting suspicious activities, unauthorized access, privilege escalation, malware indicators, anomalous network traffic, data exfiltration, and other potential security threats.
• Investigate security alerts by correlating events across multiple log sources, identifying indicators of compromise, and providing actionable findings to the Security Operations and Incident Response teams.
• Perform initial triage and analysis of security events, distinguish potential threats from false positives, and escalate confirmed or high-risk incidents in accordance with established procedures.
• Create and tune detection rules, correlation searches, thresholds, and alert conditions to improve detection accuracy and reduce false positives.
• Support Splunk architecture and data onboarding components, including forwarders, heavy forwarders, parsing configurations, source types, indexes, data inputs, and routing configurations, as applicable to the deployment.
• Monitor data ingestion volumes, license or workload utilization, search performance, and retention requirements; identify optimization opportunities and support capacity planning.
• Support log retention, archival, and availability requirements in accordance with organizational policies, audit obligations, and security monitoring needs.
• Integrate SIEM with threat intelligence feeds, endpoint detection and response (EDR), firewalls, identity and access management solutions, vulnerability management platforms, and other relevant security technologies.
• Support incident investigations by preparing event timelines, reviewing authentication and network activity, correlating security events, and documenting findings and recommended actions.
• Develop operational dashboards and periodic reports covering log source coverage, ingestion health, alert volumes, security events, detection effectiveness, and platform performance.
• Collaborate with Network & Security Engineering, Cloud, Infrastructure, Endpoint Security, Application Support, and Cyber Security teams to resolve logging gaps and improve enterprise-wide security visibility.
• Support the onboarding of new applications, infrastructure components, and security technologies into the SIEM platform by defining logging requirements and validating data quality.
• Participate in security incident management, problem management, change implementation, root cause analysis, and continuous service improvement initiatives.
• Maintain SIEM documentation, log source inventories, onboarding checklists, detection use-case documentation, operational procedures, troubleshooting guides, and incident investigation records.
• Ensure adherence to ITSM processes, including incident, problem, change, and service request management, along with applicable security standards and governance requirements.
• Evaluate new SIEM capabilities, conduct technical assessments and proofs of concept, and recommend improvements to strengthen detection coverage, operational efficiency, and security posture.
• 2-3 years of hands-on experience in SIEM administration, security monitoring, log management, or security engineering.
• Strong working knowledge of Splunk Enterprise and/or Splunk Cloud Splunk experience is strongly preferred.
• Experience with SPL (Search Processing Language), including search queries, field extraction, data filtering, aggregation, statistical analysis, and correlation searches.
• Hands-on experience with SIEM dashboards, alerts, scheduled searches, reports, data models, and detection use cases.
• Understanding of SIEM architecture, log collection, ingestion pipelines, parsing, normalization, indexing, search, and data retention.
• Experience onboarding and troubleshooting logs from firewalls, routers, switches, servers, Windows and Linux systems, endpoint security solutions, identity platforms, and cloud environments.
• Working knowledge of Splunk Universal Forwarders, Heavy Forwarders, inputs, outputs, indexes, source types, parsing configurations, and data routing is preferred.
• Understanding of common security log formats and protocols, including Syslog, JSON, CEF, LEEF, Windows Event Logs, and API-based log ingestion.
• Knowledge of security monitoring concepts, including authentication anomalies, privilege escalation, brute-force attempts, suspicious processes, malware activity, command-and-control communication, and data exfiltration.
• Familiarity with MITRE ATT&CK, common attack techniques, indicators of compromise (IOCs), and security event correlation.
• Experience in security alert triage, event correlation, incident investigation, false-positive analysis, and escalation procedures.
• Understanding of enterprise network and security technologies, including firewalls, VPNs, DNS, proxy/SWG, IDS/IPS, EDR, DLP, and identity and access management.
• Basic understanding of TCP/IP, DNS, HTTP/HTTPS, authentication protocols, and network traffic analysis to support security investigations.
• Experience integrating SIEM with security platforms, threat intelligence sources, vulnerability management tools, and incident response workflows.
• Understanding of log source coverage, ingestion monitoring, retention policies, data quality, and SIEM operational health.
• Familiarity with ITSM platforms such as ServiceNow and monitoring tools such as PRTG, SolarWinds, or equivalent is preferred.
• Knowledge of scripting or automation using Python, PowerShell, or shell scripting is an advantage.
• Exposure to SOAR, automated incident response, and security workflow automation is desirable.
• Relevant certifications such as Splunk Core Certified User/Power User, Splunk Enterprise Certified Admin, or equivalent SIEM/security certifications are preferred.
• Strong analytical, problem-solving, documentation, communication, and cross-functional collaboration skills.