> Markdown version of [/jobs/ext/2065107-cloud-security-siem-engineer](https://www.wearedevelopers.com/jobs/ext/2065107-cloud-security-siem-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # CLOUD SECURITY & SIEM ENGINEER - **Company:** Technet, LLC - **Location:** United States (Remote available) - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Application Programming Interfaces (APIs), Amazon Web Services, Amazon S3, Audit Trail, Bash Shell, Cloud Computing Security, Cyber Security, Databases, Data Transmissions, Data Infrastructure, Data Integration, Data Sharing, Linux, Middleware, File Transfer, Identity and Access Management, Internet Information Services (IIS), Virtual Private Networks (VPN), JSON, Python (Programming Language), Microsoft SQL Server, Windows Servers, Salesforce.Com, Security Information and Event Management, Data Streaming, Software Vulnerability Management, Extensible Markup Language (XML), YAML, Scripting, Indexer, Amazon Virtual Private Cloud (VPC), Amazon Relational Database Service, Information Technology, Enterprise Integration, Route53, Opsworks, Amazon Simple Queue Service (SQS), Network Server, Api Management, Security Orchestration, Automation & Response - **Published:** August 15, 2026 - **Apply:** https://www.dice.com/job-detail/4ec5aef6-0615-404e-96f9-3658653b1dc6 ## About the Role * Experience: 4+ years of hands-on experience in Cloud Security Engineering, SIEM Administration, or SecOps within AWS enterprise environments. * SIEM & Log Engineering: Deep practical expertise deploying and managing Wazuh (or ELK/OpenSearch-based security stacks), including writing custom XML decoders, rules, and managing agent fleets. * AWS Security Core: Strong hands-on experience with GuardDuty, Security Hub, AWS WAF, AWS Config, Systems Manager (SSM), IAM policy design, and multi-VPC networking (Transit Gateway). * Workload & Database Auditing: Experience configuring log feeds and auditing for Windows Server/IIS, Linux, and Amazon RDS SQL Server audit logs. * Integration Knowledge: Experience securing and ingesting logs from middleware and file-transfer systems (e.g., GoAnywhere MFT, Dell Boomi, API connectors). * Scripting: Proficiency in Python, Bash, and JSON/YAML for security automation and API integrations. * U.S. Data Residency Requirement: Must reside and work exclusively within the United States. 5. Preferred Qualifications & Certifications * AWS Certified Security - Specialty * AWS Certified Solutions Architect (Associate or Professional) * GIAC Cloud Security Automation (GCSA), GCED, or CISSP * Experience with utility, energy-sector, or NERC/CIP-adjacent regulated cloud environments. ## Description Technet is seeking a hands-on Cloud Security & SIEM Engineer to deploy, configure, and maintain the cybersecurity architecture for a critical energy-sector utility billing and data platform hosted in AWS (us-west-2). In this role, you will lead the implementation and engineering of an enterprise high-availability (HA) Wazuh SIEM cluster deployed in a dedicated, tenant-isolated AWS management VPC. You will be responsible for telemetry pipelines across AWS-native security services, CrowdStrike Falcon EDR integration, containerized Prowler Cloud Security Posture Management (CSPM), and security monitoring for third-party middleware and data transfer tiers. 2. Technical Stack & Systems Managed * SIEM & Endpoint: Wazuh (HA Manager Cluster, Indexer, Dashboard, Agents, File Integrity Monitoring [FIM], Security Configuration Assessment [SCA]), CrowdStrike Falcon (Streaming API, Falcon Data Replicator / FDR). * AWS Native Security & Infrastructure: Amazon GuardDuty, AWS Security Hub, AWS WAF, AWS Config, AWS Systems Manager (SSM), CloudTrail, VPC Flow Logs, Route 53 Resolver logs, S3 Access Logs, EventBridge, SQS, Transit Gateway, AWS Directory Service. * CSPM & Compliance Automation: Containerized Prowler, CIS AWS Foundations Benchmark, SOC 2 Type II, NIST 800-53. * Middleware & Data Integration Tiers: GoAnywhere Managed File Transfer (MFT), Dell Boomi Middleware, Salesforce CRM API feeds, PG&E data exchanges. * Operating Systems & Databases: Windows Server (IIS Web Tier), Linux workloads, Amazon RDS (Microsoft SQL Server Audit Logs)., * Wazuh SIEM Implementation & Cluster Administration: Deploy, configure, and maintain a high-availability Wazuh SIEM manager cluster in a dedicated AWS management VPC. Deploy and tune Wazuh agents across Windows/IIS web nodes, Linux instances, middleware servers, and MFT nodes. * AWS Telemetry Pipeline Engineering: Architect and validate centralized log ingestion using AWS EventBridge, SQS, CloudTrail, VPC Flow Logs, Route 53 Resolver logs, and S3 server access logs into the SIEM correlation pipeline. * EDR Integration: Ingest CrowdStrike Falcon telemetry via Streaming API / FDR into Wazuh to correlate endpoint activity with cloud control plane logs without endpoint resource contention. * Integration Edge & MFT Security: Develop custom log parsers, decoders, and alerting rules for high-risk integration boundary systems, specifically GoAnywhere MFT, Dell Boomi, Salesforce integrations, and external PG&E utility feeds. * CSPM & Continuous Compliance: Deploy and automate containerized Prowler scans and AWS Config rules to deliver daily posture assessments mapped to SOC 2 Type II, CIS AWS Foundations Benchmark, and NIST 800-53 standards. * Vulnerability Management & Configuration Hardening: Operationalize automated recurring vulnerability scans and Security Configuration Assessments (SCA) using Wazuh and AWS Systems Manager (SSM); track and support infrastructure remediation. * Identity & Access Security: Assist with MFA deployment and continuous auditing across AWS Directory Service, VPN endpoints, and GoAnywhere MFT exchanges. * Encryption Validation: Continuously validate encryption-in-transit and encryption-at-rest across S3, EBS, and RDS SQL Server databases. ## Related Videos - [Hacking MSSQL on Cloud. All of them. How I became sysadmin on Azure, AWS, GCP and Alibaba.](https://www.wearedevelopers.com/videos/100339-hacking-mssql-on-cloud-all-of-them-how-i-became-sysadmin-on-azure-aws-gcp-and-alibaba) - [CI/CD with Github Actions](https://www.wearedevelopers.com/videos/856-ci-cd-with-github-actions) - [Tips and Tricks for Working with JSON](https://www.wearedevelopers.com/videos/1229-tips-and-tricks-for-working-with-json) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Docker Compose: Rediscovered](https://www.wearedevelopers.com/videos/1978-docker-compose-rediscovered) ## Related Articles - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [7 Cloud Computing Trends Coming in 2025 for Developers](https://www.wearedevelopers.com/magazine/412-7-cloud-computing-trends-coming-in-2025-for-developers) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)