SIEM Lead

We are seeking an experienced

SIEM & Security Analytics Engineer (SIEM Lead)

to design, develop, and enhance our detection capabilities across multiple SIEM platforms. This role involves building advanced correlation rules, use cases, and SOAR playbooks while integrating new log sources from both on-premises and cloud environments. The SIEM Lead will also drive security automation initiatives, improve detection engineering processes, and provide thought leadership for our SOC teams.

Key Responsibilities

Design and develop

new SIEM rules, correlation logic, and use cases

based on diverse log sources, including

cloud security .

Write and fine-tune correlation, grouping, and logical rules in SIEM platforms (e.g.,

Splunk, Google Chronicle, AlienVault ).

Integrate new log sources and assets into SIEM; validate data ingestion and enrichment.

Build and maintain

SOAR playbooks

to automate detection and response processes.

Customize

SIGMA rules

and map use cases to the

MITRE ATT&CK framework .

Create advanced threat detection content using datasets like Proxy, VPN, Firewall, DLP, and Cloud logs.

Collaborate with SOC teams to develop and refine SOPs, work instructions, and runbooks.

Use threat intelligence and threat hunting outputs to build custom detection content.

Identify gaps in existing detection coverage and propose

new security controls .

Conduct testing and deployment of new use cases, ensuring continuous optimization.

Mentor junior analysts / engineers and contribute to team capability building.

Required Skills & Experience

7+ years of experience

in SIEM content engineering, rule development, and security analytics.

Strong knowledge of

MITRE ATT&CK framework

and its application in rule / use case development.

Proven expertise in

SIEM platforms

(Splunk, ELK, Google Chronicle, AlienVault, or equivalent).

Hands-on experience with

SOAR platforms , automation, and orchestration workflows.

In-depth knowledge of

log formats

(firewall, proxy, VPN, DLP, endpoint, cloud) and ability to create new detections.

Strong understanding of

networking concepts

(TCP / IP, routing, protocols) and

security technologies

(Firewall, IDS / IPS, VPN, EDR, DLP, Malware Analysis, Cloud Security Tools).

2+ years of experience working with

cloud infrastructures

(AWS, Azure, GCP).

Proficiency in writing

queries, correlation rules, and security analytics content

(Splunk SPL, ELK queries, etc.).

Experience with

incident analysis

and ability to interpret, manipulate, and enrich data across enterprise SIEM / ITSM platforms.

Knowledge of

Windows / Linux internals , exploitation techniques, and malware behavior analysis.

Familiarity with

standard hacking tools and attack techniques .

Qualifications

Bachelor’s degree in

Computer Science, Information Technology, or related field .

Strong analytical, problem-solving, and communication skills (written & verbal).

Security certifications are highly desirable :

Splunk Certified, Elastic Certified, CEH, CISSP, OSCP, Security+

or equivalent.