Job
Description
Role Overview: You will focus on building, operating, and continuously improving SIEM capabilities to enable proactive threat detection, efficient investigations, and scalable security monitoring across a global, cloud-first enterprise. Key Responsibilities: - Design, implement, and operate SIEM capabilities using CrowdStrike NGSIEM - Lead onboarding of new log sources, develop custom parsers, normalize fields, and validate data - Build, tune, and maintain detection rules, correlation logic, and alerting aligned with real-world threats and MITRE ATT&CK - Create and maintain dashboards and visualizations to support SOC operations, leadership reporting, and compliance requirements - Use CrowdStrike Query Language (CQL) for advanced investigations, threat hunting, and data analysis - Design and manage log ingestion pipelines using Cribl, including routing, enrichment, filtering, and transformation - Develop and maintain automation and API-based integrations to streamline data onboarding, detection deployment, and operational workflows - Partner with SOC analysts, cloud teams, and platform owners to ensure high-quality, security-relevant telemetry - Act as a technical escalation point for SIEM-related investigations and incident response - Continuously improve detection fidelity, data quality, and SIEM performance - Support audit and compliance initiatives through monitoring, reporting, and evidence generation - Document SIEM architecture, data flows, detection logic, and operational runbooks Qualifications Required: - 5 - 8 years of hands-on experience in SIEM engineering, detection engineering, or security monitoring - Strong hands-on experience with CrowdStrike NGSIEM is required - Candidates without NGSIEM experience must demonstrate deep, hands-on SIEM engineering experience using Splunk in enterprise environments - Proven experience developing custom parsers and onboarding diverse log sources - Hands-on experience with CrowdStrike Query Language (CQL) or equivalent SIEM query languages - Strong experience building detection rules, dashboards, and alerting for SOC operations - Hands-on experience with Cribl for log routing, enrichment, and pipeline optimization - Experience with automation and API-based integrations - Solid understanding of security telemetry, log formats, and large-scale log ingestion architectures - Ability to work effectively in a global, fast-paced environment Additional Company Details: Our values unite us and are the driving force behind our success and that of our customers. For more information on our core values, please visit our website. (Note: The specific URL for the core values section on the company's website should be provided if available) Role Overview: You will focus on building, operating, and continuously improving SIEM capabilities to enable proactive threat detection, efficient investigations, and scalable security monitoring across a global, cloud-first enterprise. Key Responsibilities: - Design, implement, and operate SIEM capabilities using CrowdStrike NGSIEM - Lead onboarding of new log sources, develop custom parsers, normalize fields, and validate data - Build, tune, and maintain detection rules, correlation logic, and alerting aligned with real-world threats and MITRE ATT&CK - Create and maintain dashboards and visualizations to support SOC operations, leadership reporting, and compliance requirements - Use CrowdStrike Query Language (CQL) for advanced investigations, threat hunting, and data analysis - Design and manage log ingestion pipelines using Cribl, including routing, enrichment, filtering, and transformation - Develop and maintain automation and API-based integrations to streamline data onboarding, detection deployment, and operational workflows - Partner with SOC analysts, cloud teams, and platform owners to ensure high-quality, security-relevant telemetry - Act as a technical escalation point for SIEM-related investigations and incident response - Continuously improve detection fidelity, data quality, and SIEM performance - Support audit and compliance initiatives through monitoring, reporting, and evidence generation - Document SIEM architecture, data flows, detection logic, and operational runbooks Qualifications Required: - 5 - 8 years of hands-on experience in SIEM engineering, detection engineering, or security monitoring - Strong hands-on experience with CrowdStrike NGSIEM is required - Candidates without NGSIEM experience must demonstrate deep, hands-on SIEM engineering experience using Splunk in enterprise environments - Proven experience developing custom parsers and onboarding diverse log sources - Hands-on experience with CrowdStrike Query Language (CQL) or equivalent SIEM query languages - Strong experience building detection rules, dashboards, and alerting for SOC operations - Hands-on experience with Cribl for log routing, enrichment, and pipeline optimization - Experience with automation and API-based integrations - Solid unders
