> Markdown version of [/jobs/ext/2199929-siem-engineer](https://www.wearedevelopers.com/jobs/ext/2199929-siem-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# SIEM Engineer

- **Company:** Zachary Piper
- **Location:** Durham, NC, United States
- **Experience:** Experienced
- **Salary:** $105,000.0 - $120,000.0
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Intrusion Detection and Prevention, Performance Tuning, Security Information and Event Management, Data Ingestion, Splunk, Security Orchestration, Automation & Response
- **Published:** August 23, 2026
- **Apply:** https://www.careerjet.com/job/us79912bd16e4c64f812442d69900d4cc6/eaa

## About the Role

* Active Secret Clearance

 * 3+ years of experience in SIEM engineering, SOC operations, or incident response

 * Advanced proficiency with Splunk, including writing complex SPL queries and building production-grade dashboards (similar to Ashley Brown-level experience)

 * Experience integrating AWS services (such as AWS Security Hub) and other security tools into a centralized SIEM platform

 * Strong understanding of data onboarding, CIM normalization, and Splunk knowledge objects, with the ability to operate in high-pressure environments

 * Ability to work onsite twice weekly in RTP - Tuesday and Thursday

## Description

Zachary Piper Solutions is seeking a SIEM Engineer to join a leading client in the cybersecurity and defense industry in the RTP area. The SIEM Engineer role is a hybrid position requiring onsite presence on Tuesdays and Thursdays. The SIEM Engineer is best suited for a security professional with strong Splunk expertise, AWS exposure, and experience in SOC or incident response environments who thrives in a fast-paced, mission-driven setting.
Responsibilities of the SIEM Engineer include:

 * Engineer and enhance Splunk Enterprise Security detections, dashboards, and correlation searches to strengthen threat visibility

 * Build and support automation workflows and playbooks within Splunk SOAR to streamline response efforts

 * Integrate and normalize diverse security data sources into Splunk while ensuring data quality and performance optimization

 * Partner with SOC and engineering teams to refine detection capabilities and improve operational efficiency across the environment

 * Lead and support incident investigations, coordinating response actions and contributing to continuous monitoring coverage, Piper Companies is seeking a SOC / Security Automation & Integration Engineer to join a mission-driven cybersecurity environment supporting advanced security operations and threat …
 + 14 days ago


## Related Videos

- [Practical performance tuning for Serverless Java on AWS](https://www.wearedevelopers.com/videos/2075-practical-performance-tuning-for-serverless-java-on-aws)
- [When React Meets Reality: Building a Real-Time Control Room for Autonomous Vehicles](https://www.wearedevelopers.com/videos/2091-when-react-meets-reality-building-a-real-time-control-room-for-autonomous-vehicles)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Better Together: Leveraging Your Observability Tools as a SIEM](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem)
- [Tour de Force: Open-Source LLM Inference Optimization from Simple to Sophisticated](https://www.wearedevelopers.com/videos/100099-tour-de-force-open-source-llm-inference-optimization-from-simple-to-sophisticated)
- [Build Delightful Mobile Experiences with Kotlin, Realm, and Atlas Device Sync](https://www.wearedevelopers.com/videos/694-build-delightful-mobile-experiences-with-kotlin-realm-and-atlas-device-sync)

## Related Articles

- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 162: AI careers, MCP, AWS best practices & floppy sweaters](https://www.wearedevelopers.com/magazine/571-dev-digest-162-ai-careers-mcp-aws-best-practices-floppy-sweaters)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)
- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)