> Markdown version of [/jobs/ext/2838069-siem-application-engineer](https://www.wearedevelopers.com/jobs/ext/2838069-siem-application-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # SIEM Application Engineer - **Company:** BT Group - **Location:** Birmingham, UK - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Cyber Security, Data Centers, Linux, DevOps, Elasticsearch, Intrusion Detection and Prevention, Networking Basics, Network Administration, OpenStack, Performance Tuning, Query Optimization, Cloud Services, Logstash, Ansible, SAP (Applications), Security Information and Event Management, Software Engineering, YAML, Data Logging, Scripting, Load Balancing, Data Ingestion, Gitlab, Kubernetes, Apache Kafka, Kibana - **Published:** September 11, 2026 - **Apply:** https://www.careerjet.co.uk/job/gb09ac66bc91e05ab94dff5358708966ff/eaa ## About the Role * Proven experience in Software Engineering roles * Experience in some of the following technologies: o Scripting o Kubernetes o Elasticsearch - Logstash -Kibana o Kafka o ArgoCD o Gitlab pipelines o YAML o Helm o Ansible o Basic networking * Strong analytical and troubleshooting skills * Willingness to learn new technologies * Attention to detail Desirable Skills / Experience * Experience in SIEM Detection Engineering. * Experience with log source onboarding and normalisation * Knowledge of Linux, Windows and Network Administration * Knowledge and experience of cloud services (public or private), OpenStack and K8S * Devops practices ## Description The new Network SIEM is essential to BT's network security, meeting TSA requirements and improving our CAF level. Your role as a SIEM Application Engineer in Security Engineering is to support the development, implementation, operation and support of BTs Strategic SIEM development. We are seeking a skilled SIEM Security Engineer with expertise in SIEM and Security logging and monitoring to join our dynamic team. As a SIEM engineer, you will play a critical role in designing, developing, and maintaining the ingestion of our security information and event management (SIEM) system. Your focus will be on leveraging Elasticsearch and related technologies to enhance threat detection, incident response, and overall security posture. This role is based in BT's Birmingbam office & requires 3 days in office What you'll be doing * Data Ingestion and Enrichment: o Configure Elasticsearch pipelines for data ingestion from various sources, primarily from Kafka o Enhance data enrichment by integrating threat intelligence feeds and contextual information. * SIEM Solution Development: o Collaborate with security analysts and architects to design and implement SIEM solutions using Elasticsearch. o Optimize SIEM rules, alerts, and dashboards for efficient threat detection. * Query Optimization and Performance Tuning: o Write efficient Elasticsearch queries to retrieve relevant security events. o Monitor and manage the performance of the SIEM infrastructure. * Security Engineering: o Contribute to security engineering projects, transitions, and transformations. o Work closely with security operations and associated security incident response systems o Stay informed about emerging threats and security best practices., When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. Because we respect your right to privacy, you can choose not to allow some types of cookies. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. Required Cookies These cookies are required to use this website and can't be turned off. Required Cookies Show More Details Required Cookies Provider Description Enabled SAP as service provider We use the following session cookies, which are all required to enable the website to function: * "route" is used for session stickiness * "careerSiteCompanyId" is used to send the request to the correct data centre * "JSESSIONID" is placed on the visitor's device during the session so the server can identify the visitor * "Load balancer cookie" (actual cookie name may vary) prevents a visitor from bouncing from one instance to another ## Related Videos - [Better Together: Leveraging Your Observability Tools as a SIEM](https://www.wearedevelopers.com/videos/2118-better-together-leveraging-your-observability-tools-as-a-siem) - [Debug a Kubernetes Operator](https://www.wearedevelopers.com/videos/487-debug-a-kubernetes-operator) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [CI/CD with Github Actions](https://www.wearedevelopers.com/videos/856-ci-cd-with-github-actions) - [Add Location-based Searching to Site with ElasticSearch](https://www.wearedevelopers.com/videos/77-add-location-based-searching-to-site-with-elasticsearch) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) ## Related Articles - [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk) - [Software Engineer Salary London](https://www.wearedevelopers.com/magazine/252-software-engineer-salary-london) - [Software Engineer Salary in The UK](https://www.wearedevelopers.com/magazine/231-software-engineer-salary-in-the-uk) - [Top-Paying Tech Jobs (with Salaries)](https://www.wearedevelopers.com/magazine/372-top-paying-tech-jobs-with-salaries) - [Where To Find Software Engineering Jobs](https://www.wearedevelopers.com/magazine/396-where-to-find-software-engineering-jobs) - [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk)