SIEM Engineer

Hybrid: Onsite 3 days a week

Job Overview

The SIEM Engineer will provide hands-on engineering support for the design, configuration, integration, optimization, and ongoing operation of an enterprise Security Information and Event Management (SIEM) environment. This role focuses on strengthening security monitoring, threat detection, incident response, and log management capabilities while providing technical support under the direction of the Director.

Job Duties

• Engineer, configure, maintain, and optimize the enterprise SIEM platform, including Splunk and related security technologies.

• Onboard and integrate data sources, ensuring logs are properly collected, parsed, normalized, indexed, and retained.

• Develop and maintain correlation searches, alerts, dashboards, reports, detection rules, and other security monitoring content.

• Integrate SIEM capabilities with security tools, cloud platforms, applications, infrastructure, and enterprise systems.

• Monitor SIEM platform performance, capacity, availability, and overall health; troubleshoot technical issues.

• Tune alerts and detection logic to reduce false positives and improve security monitoring effectiveness.

• Support SOC analysts and incident response personnel with technical expertise, queries, dashboards, and investigative capabilities.

• Support upgrades, patches, configuration changes, testing, and implementation of SIEM infrastructure.

• Maintain technical documentation, operational procedures, system configurations, and knowledge-transfer materials.

• Collaborate with SOC, infrastructure, cloud, networking, and application teams on SIEM-related initiatives.

• Follow applicable security standards, change-management processes, and cybersecurity policies.

Required Skills

• 3 years of professional IT experience, including at least 3 years supporting SIEM, security engineering, cybersecurity operations, or security monitoring technologies.

• 3 years of experience administering or engineering Splunk Enterprise and/or Splunk Enterprise Security.

• 3 years of demonstrated experience onboarding and integrating security log sources using technologies such as syslog, APIs, agents, or cloud-native integration.

Preferred Skills

• Splunk Enterprise Certified Admin certification.

• Experience supporting a large enterprise or government environment.

• Experience developing SPL searches, dashboards, alerts, correlation searches, and reports.

• Experience troubleshooting complex SIEM, logging, data ingestion, or integration issues.

• Familiarity with cybersecurity frameworks such as NIST and MITRE ATT&CK.