SIEM Lead

We are seeking an experienced SIEM & Security Analytics Engineer (SIEM Lead) to design, develop, and enhance our detection capabilities across multiple SIEM platforms. This role involves building advanced correlation rules, use cases, and SOAR playbooks while integrating new log sources from both on-premises and cloud environments. The SIEM Lead will also drive security automation initiatives, improve detection engineering processes, and provide thought leadership for our SOC teams.

Key Responsibilities

• Design and develop new SIEM rules, correlation logic, and use cases based on diverse log sources, including cloud security .
• Write and fine-tune correlation, grouping, and logical rules in SIEM platforms (e.g., Splunk, Google Chronicle, AlienVault ).
• Integrate new log sources and assets into SIEM; validate data ingestion and enrichment.
• Build and maintain SOAR playbooks to automate detection and response processes.
• Customize SIGMA rules and map use cases to the MITRE ATT&CK framework .
• Create advanced threat detection content using datasets like Proxy, VPN, Firewall, DLP, and Cloud logs.
• Collaborate with SOC teams to develop and refine SOPs, work instructions, and runbooks.
• Use threat intelligence and threat hunting outputs to build custom detection content.
• Identify gaps in existing detection coverage and propose new security controls .
• Conduct testing and deployment of new use cases, ensuring continuous optimization.
• Mentor junior analysts / engineers and contribute to team capability building.

Required Skills & Experience

Qualifications