Description

Own the operational lifecycle and technical strategy for SIEM/SOAR platforms, ensuring telemetry ingestion, detection efficacy, and platform stability.

This role is remote.

Responsibilities

• Manage stability and performance of SIEM/SOAR pipelines, including ingestion, normalization, and quality validation of security logs.
• Develop, configure, and tune detection content (rules, use cases) to enhance threat detection capabilities.
• Define, monitor, and report on technical service level performance metrics such as detection coverage and response timelines.
• Coordinate with engineering, product, SOC, and compliance teams to integrate security services and resolve complex technical issues.
• Create and maintain operational runbooks, SOPs, and technical documentation while assisting clients with logging compliance and SEC attestation.

Required Skills

• 5+ years of experience in security operations, focusing on SIEM and SOAR platforms.
• Deep expertise in Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR).
• Proficiency in query languages including SQL, Splunk SPL, and Elastic DSL for data analysis and troubleshooting.
• Strong background in detection engineering and managing security telemetry from diverse sources.
• Experience with automation tools and scripting to drive efficiency in security workflows.
• Knowledge of logging compliance frameworks, including SEC attestation and industry standards.
• Bachelor's degree in Computer Science, Engineering, or a related technical field.

Key Skills

Education

Bachelor's degree