Executive - SIEM Engineer

We are seeking a skilled professional for the role of Executive - SIEM Engineering, with 2-3 years of relevant experience in Security Information and Event Management, security monitoring, log management, and incident investigation within an enterprise environment.

The role requires hands-on expertise in SIEM platforms, preferably Splunk Cloud, with a strong understanding of security log onboarding, parsing, normalization, correlation searches, alert engineering, dashboards, threat detection, and security incident investigation. The candidate will be responsible for maintaining SIEM platform health, improving detection capabilities, ensuring log source coverage, and supporting security operations through actionable security insights.

The ideal candidate should have experience integrating logs from enterprise infrastructure, firewalls, endpoint security, identity platforms, cloud environments, network security solutions, and other critical systems. The candidate should possess strong analytical and troubleshooting skills, with the ability to investigate security events, optimize detection rules, and collaborate with Cyber Security, Infrastructure, Network & Security Engineering, and other technology teams to strengthen the organization's security monitoring and incident response capabilities.

- 2-3 years of hands-on experience in SIEM administration, security monitoring, log management, or security engineering.
- Strong working knowledge of Splunk Enterprise and/or Splunk Cloud Splunk experience is strongly preferred.
- Experience with SPL (Search Processing Language), including search queries, field extraction, data filtering, aggregation, statistical analysis, and correlation searches.
- Hands-on experience with SIEM dashboards, alerts, scheduled searches, reports, data models, and detection use cases.
- Understanding of SIEM architecture, log collection, ingestion pipelines, parsing, normalization, indexing, search, and data retention.
- Experience onboarding and troubleshooting logs from firewalls, routers, switches, servers, Windows and Linux systems, endpoint security solutions, identity platforms, and cloud environments.
- Working knowledge of Splunk Universal Forwarders, Heavy Forwarders, inputs, outputs, indexes, source types, parsing configurations, and data routing is preferred.
- Understanding of common security log formats and protocols, including Syslog, JSON, CEF, LEEF, Windows Event Logs, and API-based log ingestion.
- Knowledge of security monitoring concepts, including authentication anomalies, privilege escalation, brute-force attempts, suspicious processes, malware activity, command-and-control communication, and data exfiltration.
- Familiarity with MITRE ATT&CK, common attack techniques, indicators of compromise (IOCs), and security event correlation.
- Experience in security alert triage, event correlation, incident investigation, false-positive analysis, and escalation procedures.
- Understanding of enterprise network and security technologies, including firewalls, VPNs, DNS, proxy/SWG, IDS/IPS, EDR, DLP, and identity and access management.
- Basic understanding of TCP/IP, DNS, HTTP/HTTPS, authentication protocols, and network traffic analysis to support security investigations.
- Experience integrating SIEM with security platforms, threat intelligence sources, vulnerability management tools, and incident response workflows.
- Understanding of log source coverage, ingestion monitoring, retention policies, data quality, and SIEM operational health.
- Familiarity with ITSM platforms such as ServiceNow and monitoring tools such as PRTG, SolarWinds, or equivalent is preferred.
- Knowledge of scripting or automation using Python, PowerShell, or shell scripting is an advantage.
- Exposure to SOAR, automated incident response, and security workflow automation is desirable.
- Relevant certifications such as Splunk Core Certified User/Power User, Splunk Enterprise Certified Admin, or equivalent SIEM/security certifications are preferred.
- Strong analytical, problem-solving, documentation, communication, and cross-functional collaboration skills.