Senior Cyber Security Engineer (SIEM)

About the role

A security engineering team is looking for a highly skilled Senior Cyber Security Engineer (SIEM) to design, implement, optimise and maintain enterprise SIEM solutions. The role ensures robust security monitoring and threat detection, working with technologies such as Splunk, Cribl, Microsoft Sentinel and CrowdStrike so the organisation can detect anomalies, respond to incidents and strengthen its cyber resilience.

Key responsibilities

• Architect, deploy, configure and maintain SIEM platforms (Splunk, Cribl, Microsoft Sentinel)
• Manage ingestion pipelines, data onboarding, parsing, normalisation and log source integration
• Develop dashboards, search queries, alerts and correlation rules, and tune them for performance and scalability
• Build and maintain detection content aligned with threat intelligence and MITRE ATT&CK, reducing false positives
• Collaborate with Incident Response teams to refine rules and support investigations
• Integrate SIEM with CrowdStrike, firewalls, EDR, identity platforms, cloud workloads and network security devices, and set up log forwarding and transformation pipelines with Cribl
• Ensure logging compliance with ISO 27001, SOC 2, NIST and other requirements, and audit ingestion, retention and access controls
• Work with SOC analysts, threat hunters, cloud engineers and infrastructure teams on SIEM projects and architecture improvements

Required profile

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science or equivalent experience
• 5+ years of cybersecurity experience with a strong SIEM engineering focus
• Proven hands-on expertise with Splunk Enterprise, Cribl Stream/Edge, Microsoft Sentinel and CrowdStrike Falcon
• Strong knowledge of log management, data pipelines, detection engineering and security analytics
• Deep understanding of security frameworks, incident response and threat detection methodologies

Required skills

• Query languages such as SPL and KQL
• Preferred: Splunk Power User / Admin, GIAC GCIA/GCIH, AZ-500 or CrowdStrike certifications
• Preferred: Python, PowerShell, Bash, cloud logging (Azure, AWS, GCP) and threat hunting experience