Security Engineer (SIEM & SOAR)

3-8 Years

Not Disclosed

Early Applicant

Job Description

What You'll Do

SIEM Engineering

Design, implement, and optimize SIEM solutions such as Splunk, Microsoft Sentinel, Google

SecOps, QRadar, and Elastic.

Develop and enhance correlation rules, dashboards, alerts, and reports to improve threat visibility.
Integrate security telemetry from cloud, endpoints, networks, and applications.
Improve data ingestion, normalization, and parsing to increase detection accuracy and reduce

noise.

SOAR & Security Automation

Build and maintain automated incident response playbooks using platforms such as Cortex XSOAR,

Splunk SOAR, or IBM Resilient.

Automate alert triage, threat intelligence enrichment, and response actions.
Partner with SOC analysts and threat hunters to streamline investigations and reduce response

times.

Integrate SOAR platforms with ticketing systems, threat feeds, and security controls.

Security Operations Support

Support incident response through actionable detections and automation-driven insights.
Perform root cause analysis and develop engineering solutions to address recurring threats.
Collaborate with compliance and audit teams to strengthen security controls.
Create documentation and provide enablement sessions for SOC and IT teams.

Required Experience

What We're Looking For

3–8 years of cybersecurity experience, with strong hands-on experience in SIEM and/or SOAR

engineering.

Experience working in a Security Operations Center (SOC) environment is highly preferred.
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.

Technical Skills

Hands-on experience with at least one SIEM platform:
Splunk
Microsoft Sentinel
Google SecOps
QRadar
ArcSight
Experience developing SOAR playbooks, workflows, and security automations.
Scripting and automation skills using Python, PowerShell, or Bash.
Knowledge of MITRE ATT&CK, NIST, CIS Controls, or similar cybersecurity frameworks.
Familiarity with EDR/XDR, IDS/IPS, firewall technologies, and cloud security (AWS, Azure, or GCP).