> Markdown version of [/jobs/ext/1950733-siem-data-engineer](https://www.wearedevelopers.com/jobs/ext/1950733-siem-data-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Siem Data Engineer

- **Company:** Capitole
- **Location:** Málaga, Spain
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Amazon Web Services, Microsoft Azure, Unix, Cloud Computing, Cyber Security, Information Technology Consulting, Linux, Github, Intrusion Detection and Prevention, OpenStack, Parsing, Regular Expressions, Ansible, Security Log, Security Information and Event Management, Data Ingestion, Kubernetes, Terraform, Splunk, Data Pipelines, Security Orchestration, Automation & Response
- **Published:** August 6, 2026
- **Apply:** https://www.buscojobs.com.es/siem-data-engineer-en-malaga-ID-366173292

## About the Role

Experience working with Cribl.
Experience with SIEM platforms (Splunk and/or Elastic).
Strong understanding of log ingestion, parsing and normalization.
Experience with Regular Expressions (Regex).
Knowledge of Security Incident Response and SIEM use cases.
Knowledge of Linux, Windows and UNIX.
Experience with GitHub.
Cloud knowledge in AWS, Azure and/or GCP.
Kubernetes and/or OpenStack knowledge is a plus.
Excellent analytical and problem-solving skills.

## Description

Capitole is one of the best IT consulting companies and the place you want to be. Why?People in the center. We believe in a different model, more human, with the employee in the center of our companyHappiness and low turnover rate€**** per year training budgetMore than 900 skilled professionals, from more than 27 nationalitiesTailored career pathWellhub: access to fitness, wellness, and mental health supportProcessing of the work permit for you to come to Spain with your familyLots of amazing eventsAt Capitole Consulting we continue growing and we are looking for a Senior SIEM Data Engineer to join an international cybersecurity team working on large-scale SIEM architectures, log processing and security automation.You will help design and optimize modern cybersecurity platforms by integrating heterogeneous log sources, building scalable data pipelines and developing advanced SIEM use cases for enterprise environments.Your responsibilitiesConnect and integrate security log sources into SIEM platforms using Cribl.Design parsers and normalize log data for efficient security monitoring.Develop and optimize log processing and routing pipelines.Create and document SIEM data models and security use cases.Participate in security assessments to identify detection opportunities.Improve SIEM detection capabilities and support continuous platform evolution.Collaborate with operations teams to automate and optimize log processing.Contribute to Proofs of Concept around new cybersecurity standards and technologies.Support incident response processes through high-quality log engineering.RequirementsExperience working with Cribl.Experience with SIEM platforms (Splunk and/or Elastic).Strong understanding of log ingestion, parsing and normalization.Experience with Regular Expressions (Regex).Knowledge of Security Incident Response and SIEM use cases.Knowledge of Linux, Windows and UNIX.Experience with GitHub.Cloud knowledge in AWS, Azure and/or GCP.Kubernetes and/or OpenStack knowledge is a plus.Excellent analytical and problem-solving skills.Nice to haveTerraformAnsibleGitHub ActionsSecurity automationOCSFSOAR platformsThe employee will adhere to information security policies:-Will have access to confidential information related to Capitole and the project they are working on.-Must comply with the security policies and internal policies of the company and the client.#J-*****-Ljbffr


## Related Videos

- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [WeAreDevelopers LIVE - Node and Package Security](https://www.wearedevelopers.com/videos/2138-wearedevelopers-live-node-and-package-security)
- [From Messy Queries to Scalable Systems - How Data Engineering actually works](https://www.wearedevelopers.com/videos/100203-from-messy-queries-to-scalable-systems-how-data-engineering-actually-works)
- [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker)
- [Alibaba Big Data and Machine Learning Technology](https://www.wearedevelopers.com/videos/37-alibaba-big-data-and-machine-learning-technology)

## Related Articles

- [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk)
- [Top-Paying Tech Jobs (with Salaries)](https://www.wearedevelopers.com/magazine/372-top-paying-tech-jobs-with-salaries)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market)
- [Where To Find Software Engineering Jobs](https://www.wearedevelopers.com/magazine/396-where-to-find-software-engineering-jobs)