> Markdown version of [/jobs/ext/1223494-security-engineer-siem-hybrid](https://www.wearedevelopers.com/jobs/ext/1223494-security-engineer-siem-hybrid). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer SIEM - Hybrid

- **Company:** Anson McCade
- **Location:** London, UK
- **Salary:** £72,000.0 - £82,000.0
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Microsoft Azure, Cloud Computing, Cyber Security, Computer Networks, System Configuration, Identity and Access Management, Intrusion Detection and Prevention, Microsoft Software, Security Information and Event Management, TCP/IP, Virtual Machines, Software Vulnerability Management, Computer Network Technologies, Data Ingestion, Cyber Threat Analysis, Microsoft Sentinel, Splunk, Security Orchestration, Automation & Response
- **Published:** July 10, 2026
- **Apply:** https://www.totaljobs.com/job/security-engineer-siem/anson-mccade-job107669271

## About the Role

* Strong experience designing, building, deploying and operating SIEM and SOAR platforms
 * Hands-on experience with Splunk and/or Microsoft Sentinel, ideally with strong exposure to both
 * Experience with technologies such as Splunk Enterprise Security, Splunk SOAR, UBA, Elastic or Microsoft XDR
 * Proven experience deploying and configuring SIEM platforms across cloud and/or on-premises environments
 * Experience supporting high-volume data ingestion environments
 * Strong experience with log collection and onboarding data sources into a SIEM
 * Ability to define and develop threat-led detection use cases, playbooks and automation content
 * Experience integrating SIEM platforms with identity management, vulnerability management, asset management, threat intelligence and case management systems
 * Strong knowledge of Azure and/or AWS security controls and detection capabilities
 * Experience deploying security technologies across cloud, containerised and virtual machine environments
 * Strong understanding of enterprise ICT and security architecture
 * Good networking knowledge, including TCP/IP and the ability to identify normal and abnormal network traffic
 * Detailed understanding of threat intelligence, threat actors and TTPs
 * Experience developing technical test procedures against functional and non-functional requirements
 * Strong technical documentation and client-facing communication skills

## Description

The SIEM Engineer will support the design, deployment, configuration and ongoing development of the SOC's security monitoring capability. The role will work across technologies including Splunk, Microsoft Sentinel, SOAR, Microsoft XDR and wider security tooling, with a major focus on SIEM engineering, data onboarding, integrations, detection content and threat-led use cases.


## Related Videos

- [Better Together: Leveraging Your Observability Tools as a SIEM](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem)
- [An Applied Introduction to eBPF with Go](https://www.wearedevelopers.com/videos/1075-an-applied-introduction-to-ebpf-with-go)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [Turning Container security up to 11 with Capabilities](https://www.wearedevelopers.com/videos/718-turning-container-security-up-to-11-with-capabilities)

## Related Articles

- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)