Role Overview :

We are looking for a Senior SIEM Engineer with strong hands-on experience in SIEM platform administration, log integration, parsing, detection engineering, and performance optimization within an enterprise SOC/MSSP environment.

Key Responsibilities :

- Administer, maintain, and optimize enterprise SIEM platforms.

- Onboard log sources and develop custom parsers, field extraction, and log normalization.

- Develop, tune, and optimize correlation rules, detection use cases, and threat-hunting queries aligned with MITRE ATT&CK.

- Create searches, dashboards, and reports while reducing false positives.

- Monitor SIEM health, event processing, indexing, storage, and system performance.

- Troubleshoot production issues, support upgrades, patching, and critical incidents.

- Integrate security logs from firewalls, IDS/IPS, EDR, Windows/Linux, cloud, applications, and identity platforms.

- Ensure log collection using Syslog, CEF, LEEF, JSON, XML, and custom formats.

- Support automation, SOAR integrations, documentation, and continuous service improvement.

Required Technical Skills:

- SIEM Engineering: Platform administration, log onboarding, parsing, normalization, event correlation, and troubleshooting.

- Detection Engineering: Correlation rules, use-case development, rule tuning, threat hunting, and MITRE ATT&CK.

- Platform Management: Health monitoring, performance optimization, indexing, storage, upgrades, and capacity planning.

- Security Technologies: Firewalls, IDS/IPS, EDR, Windows/Linux, Active Directory, network devices, and cloud security.

- Networking & Logs: TCP/IP, DNS, HTTP/HTTPS, Syslog, authentication protocols, CEF, LEEF, JSON, and XML.

- Automation: Python, PowerShell, or Shell scripting; REST APIs and SOAR integrations are preferred.

- Cloud & Threat Intelligence: AWS/Azure/GCP/OCI and threat intelligence integrations are an advantage.

Experience & Qualifications :

- 5 - 8 years in cybersecurity, including at least 4 years in SIEM or security platform engineering.

- Hands-on experience in enterprise SOC/MSSP environments, preferably supporting 24x7 operations.

- Strong troubleshooting, analytical, documentation, and client communication skills.

- SIEM vendor certifications or Security+, CySA+, GCIH, GCIA, or equivalent certifications are preferred.