> Markdown version of [/jobs/ext/2990721-siem-soar-automation-sme](https://www.wearedevelopers.com/jobs/ext/2990721-siem-soar-automation-sme). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # SIEM/ SOAR Automation SME - **Company:** Koninklijke Philips N.V. - **Location:** Amsterdam, Netherlands - **Experience:** Experienced - **Salary:** €5,100.0 - €8,492.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Microsoft Azure, Cloud Computing, CompTIA Security+, Cyber Security, Software Debugging, Identity and Access Management, Python (Programming Language), Key Management, Network Security, Microsoft Security Essentials, Routing, Parsing, Windows PowerShell, Runbook, Security Information and Event Management, Data Logging, Data Ingestion, Information Technology, Performance Monitor, Microsoft Sentinel, Enterprise Integration, Cyber Warfare, Splunk, Data Pipelines, Api Management, Security Orchestration, Automation & Response, Servicenow - **Published:** September 19, 2026 - **Apply:** https://www.adzuna.nl/details/5889606030 ## About the Role * Bachelor's or Master's degree in Computer Science, Information Technology, Cybersecurity, or equivalent. * With a Bachelor's degree, a minimum of 2 years of relevant experience in Security Architecture, Network Security, Cybersecurity Technology, Information Security, or equivalent. With a Master's degree. Technical and professional capabilities * Demonstrated hands-on experience supporting SIEM platforms, including search troubleshooting, performance monitoring, detection support, data onboarding and integration management. * Practical experience developing, maintaining, testing and troubleshooting SOAR playbooks, scripts and API integrations using Python, PowerShell or comparable technologies. * Understanding secure authentication, authorization, secrets management and least-privilege access when implementing automations and integrations. * Practical understanding of log collection, parsing, routing and delivery mechanisms, including syslog, HTTP Event Collector, APIs, queues and cloud-native ingestion patterns. * Working knowledge of cloud platforms, especially AWS and Azure, including cloud logging, identity, security services and integration patterns. * Ability to investigate complex service issues, assess operational risk, coordinate technical changes and restore critical services with internal teams and vendors. * Experience using AI-assisted development and automation responsibly to build, test, debug and maintain scripts, playbooks and integrations. Ability to validate AI-generated output for correctness, security and reliability before production use. * Strong documentation and reporting skills, including KPI analysis, service-level reporting and communication with both technical and non-technical stakeholders. * Ability to work independently, prioritize business-critical issues and communicate fluently in English. Preferred qualifications * Experience supporting security platforms in a multinational environment and coordinating managed service providers. Familiarity with ServiceNow, MISP, Microsoft security and identity services, Splunk Cloud, or Microsoft Sentinel. * Familiarity with NIST and CIS security practices and ITIL service management. Relevant Splunk, cloud, Sentinel, or cybersecurity certifications are an advantage. ## Description A SIEM/SOAR Automation Subject Matter Expert responsible for the ongoing operation, maintenance, and reliability of our primary Security Operations Center (SOC) platform. This business-critical role keeps security monitoring, data ingestion, and response automation dependable across Philips. The scope covers Security Information and Event Management (SIEM), Security Orchestration, Automation and Response (SOAR), and the supporting data pipelines and integrations.You will apply deep technical expertise and independent judgement under broad guidelines, working with the SOC, engineering teams, and service partners to resolve complex issues and improve platform performance and resilience. The Philips Group Security team, dedicated to safeguarding our customers, employees, and partners worldwide. Within Group Security - Information Security (GS-IS), the Cybersecurity Processes and Tooling department develops and operates the capabilities that support enterprise cyber defense. You will work closely with the SOC, IAM, ITaaP, cloud and engineering teams, and external service providers. * Manage the operational health of SIEM, SOAR and Security Data Pipelines. Monitor availability, performance, capacity, and platform alerts, and drive recovery from failures that affect SOC visibility or response. * Evaluate releases and new features, optimize searches, and investigate failed searches and other platform integrations. Coordinate detection-related issues with the SOC. * Investigate complex data ingestion issues escalated by the first-line service team. Coordinating engineering changes and service restoration with managed service providers, platform teams and vendor support. Driving root-cause analysis and preventive actions for recurring issues. * Coordinate upgrades and engineering changes with the managed service teams. For vendor-managed SOAR Cloud releases, review release notes, assess impacts, approve or defer maintenance windows within agreed authority, and validate playbooks after upgrades. * Maintaining and improving SOAR playbooks, scripts and API integrations in collaboration with SOC analysts and automation-development peers. This includes safe testing, error handling, permissions management and post-change validation. * Supporting secure administration and operational management of data pipelines, including approved emergency load-distribution and routing changes where required. * Track service levels and define and report KPIs for platform health, ingestion reliability, failed searches, playbook execution, and incident resolution. Use findings to prioritize corrective actions and service improvements. * Maintain runbooks, configuration and integration documentation, operating procedures, and knowledge-transfer material. Participate in security and solution reviews, apply secure configuration and change controls, and support investigations with reliable platform data. * Coordinate vendors and internal stakeholders through incidents, maintenance, and releases. * Identifying and implementing practical AI-assisted automation opportunities that improve engineering productivity, platform reliability and SOC effectiveness, with appropriate validation and security controls. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Tips and Tricks for Working with JSON](https://www.wearedevelopers.com/videos/1229-tips-and-tricks-for-working-with-json) - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Technical Documentation - How Can I Write Them Better and Why Should I Care?](https://www.wearedevelopers.com/videos/681-technical-documentation-how-can-i-write-them-better-and-why-should-i-care) - [Securing your application software supply-chain](https://www.wearedevelopers.com/videos/468-securing-your-application-software-supply-chain) - [Building a Compiler with C#](https://www.wearedevelopers.com/videos/116-building-a-compiler-with-c) ## Related Articles - [Best Companies in the Netherlands: Top 25 Companies in 2023 ](https://www.wearedevelopers.com/magazine/193-best-companies-in-the-netherlands-top-25-companies-in-2023) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers) - [Software Developer Salary in The Netherlands [2023]](https://www.wearedevelopers.com/magazine/217-software-developer-salary-in-the-netherlands-2023) - [How to land a developer job in Amsterdam](https://www.wearedevelopers.com/magazine/36-how-to-land-a-developer-job-in-amsterdam)