> Markdown version of [/jobs/ext/1472028-forward-deployed-data-engineer-siem-soar](https://www.wearedevelopers.com/jobs/ext/1472028-forward-deployed-data-engineer-siem-soar). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Forward Deployed Data Engineer - SIEM/SOAR

- **Company:** TENEX SECURITY, INC.
- **Location:** Scottsdale, AZ, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Amazon Web Services, Cyber Security, Intrusion Detection and Prevention, Python (Programming Language), Kusto Query Language, Security Information and Event Management, Google Cloud, Mitre Att&ck, Information Technology, Microsoft Sentinel, Restful APIs, Api Management
- **Published:** July 28, 2026
- **Apply:** https://www.dice.com/job-detail/e130c272-dbca-4944-9d0c-4384c8e7e467

## About the Role

Technical & Industry Expertise

 * 3+ years in detection engineering, content engineering, or security operations
 * Strong proficiency in SIEM detection rule development - YARA-L for Google SecOps, KQL for Sentinel, or similar
 * Experience building and maintaining SOAR playbooks and automation workflows
 * Proficiency with log parser development for diverse data source types
 * Knowledge of MITRE ATT&CK framework and its application to detection content
 * Experience with Python, cloud run functions, and REST API integrations
 * Experience building security dashboards for operational use cases
 * Understanding of threat intelligence and how TTPs translate into actionable detection logic

Soft Skills

 * Strong problem-solving and troubleshooting skills with a bias toward action
 * Excellent customer-facing communication and collaboration abilities
 * Ability to thrive in a fast-paced, high-performance startup environment
 * Passion for cybersecurity, automation, and continuous improvement

Education & Certifications

 * Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field (or equivalent practical experience)
 * Relevant certifications such as CISSP, CISM, GIAC certifications, Google Cloud Professional, Microsoft SC-200/AZ-500, or AWS Certified Solutions Architect are a plus

## Description

As a Forward Deployed Data Engineer - SIEM/SOAR, you build the content that powers TENEX's MDR delivery. From detection rules and log parsers to SOAR playbooks, dashboards, and custom API integrations, your work is what makes the platform intelligent. You are also a technical trainer - helping customers understand the content they're running and the platform they're operating., * Author, tune, and maintain detection rules, correlation logic, and threat content across Google SecOps and Microsoft Sentinel

 * Build and validate log parsers for new data sources integrated into customer environments
 * Develop and maintain SOAR playbooks, automation workflows, and dashboards for common alert types and operational use cases
 * Build cloud run functions, scripts, and API integrations where native connectors or content do not exist
 * Collaborate with Deployment Engineers to ensure content is ready for new customer go-lives
 * Monitor detection coverage gaps and proactively develop content to address them
 * Incorporate threat intelligence and adversary TTPs (MITRE ATT&CK) into detection logic
 * Serve as an advanced enablement resource for customers - training them on detection content, dashboards, and platform capabilities at a deeper technical level
 * Document all content with clear metadata, use cases, and tuning notes
 * Support AI-assisted content generation workflows with human review as the quality gate


## Related Videos

- [Rest API Antipatterns](https://www.wearedevelopers.com/videos/100208-rest-api-antipatterns)
- [The Cloud is Calling: Answer with In-Demand Skills](https://www.wearedevelopers.com/videos/945-the-cloud-is-calling-answer-with-in-demand-skills)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)
- [REST In Peace: Why LLMs Can't CRUD](https://www.wearedevelopers.com/videos/100272-rest-in-peace-why-llms-can-t-crud)
- [Cloud Run- the rise of serverless and containerization](https://www.wearedevelopers.com/videos/106-cloud-run-the-rise-of-serverless-and-containerization)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)

## Related Articles

- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)
- [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)