Tech Stack
AWSAzureCloudGoogle Cloud PlatformSplunk
About the role
- Design, implement, and optimize detection use cases across SIEM platforms
- Participate in client standups and working sessions to capture business requirements
- Apply SIEM setup and operations knowledge, including data normalization
- Collaborate with engineering, SOC, CTI, and OSO teams and maintain documentation in Confluence and Gitlab/GitHub
- Identify gaps and drive improvements in detection coverage, scalability, and automation
Requirements
- Proficiency with at least two of Microsoft Sentinel (KQL), Splunk (SPL), or Google SecOps (YARA-L)
- Demonstrated experience building, tuning, and maintaining detections in enterprise SIEM environments
- Understanding of data ingestion, parsing, normalization, and schema alignment
- Strong communication skills and experience engaging with customers
- Working knowledge of JIRA, Confluence, and related workflow tools
- Preferred: Experience with detection frameworks (e.g., MITRE ATT&CK), cloud-native services (Azure, AWS, GCP), or prior SOC/MSSP experience