> Markdown version of [/jobs/ext/3278783-principal-cyber-security-engineer](https://www.wearedevelopers.com/jobs/ext/3278783-principal-cyber-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Principal Cyber Security Engineer - **Company:** Ally Financial Inc. - **Location:** Detroit, MI, United States (Remote available) - **Experience:** Expert - **Salary:** $110,000.0 - $180,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Agile Methodology, Amazon Web Services, Proxy Servers, JIRA, Audit Trail, Microsoft Azure, BigQuery, Software as a Service, Cloud Computing, Apache Lucene, Cyber Security, Continuous Integration, Data Governance, Linux, Disaster Recovery, Domain Name System (DNS), Identity and Access Management, Networking Hardware, Intrusion Detection and Prevention, Intrusion Detection Systems, Network Security, Parsing, PCI Data Security Standards, Performance Tuning, Role-Based Access Control, Regular Expressions, Cloud Services, Ansible, Kusto Query Language, Security Information and Event Management, Azure Service Bus, Data Logging, Data Processing, Scripting, System Availability, Snowflake, Mitre Att&ck, QRadar, Malware, Indexer, Firewalls (Computer Science), Data Lakes, Kubernetes, Information Technology, Microsoft Sentinel, Apache Kafka, Sumo Logic (Software), Cloudwatch, Restful APIs, Terraform, Splunk, Data Pipelines, Servicenow - **Published:** September 30, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=5fe13ff08abb59c1 ## About the Role * 5+ years of experience in SIEM engineering or closely related security engineering roles. * Bachelor's degree in Computer Science, Information Security, or related field; or equivalent experience. * Proven expertise with at least one enterprise SIEM platform end-to-end, preferably Splunk and Cribl (e.g., Splunk, Microsoft Sentinel, QRadar, Elastic Security, Exabeam, Sumo Logic, LogRhythm, Chronicle). * Strong proficiency in: + Data parsing and normalization (e.g., regex, grok, KQL, SPL, AQL, Lucene). + Detection rule creation, correlation logic, and tuning. + Scripting/automation (e.g., Python, PowerShell, REST APIs, Terraform/Ansible preferred). + Log source onboarding from Windows/Linux, AD, network devices, cloud services, EDR, and SaaS. * Hands-on experience integrating SIEM with SOAR, ticketing (e.g., ServiceNow, JIRA), and case management. * Good understanding of security operations, incident response workflows, and threat detection frameworks (MITRE ATT&CK, NIST 800-61). * Experience with public cloud platforms (AWS, Azure, etc.) * Experience with cloud logging and security services (e.g., AWS CloudTrail/CloudWatch/GuardDuty, Azure Defender/M365, GCP Audit Logs). * Knowledge of data pipelines and messaging (e.g., Kafka, Kinesis, Event Hubs) and storage tiers (object storage, hot/warm/cold). * Experience with Agile methodologies and collaborative work environments. * Familiarity with identity and access management, network security, endpoint security, and common enterprise architectures. * Strong documentation skills and experience with IaC/CI-CD for detection content a plus., * Multiple SIEM platform experience (migrations, hybrid environments). * Experience with UEBA/behavior analytics and anomaly detection. * Experience with EDR/XDR integrations and telemetry correlation. * Exposure to data lakes, lakehouses, or security data fabrics (e.g., Snowflake, BigQuery). * Certifications: GCDA, GCIA, GCFE, GCIH, GMON, Splunk Certified Architect, Microsoft Certified: Cybersecurity Architect, AWS/Azure security certs, CISSP. * Experience operating in regulated environments (e.g., financial services, healthcare). * Background in purple teaming, threat hunting, or malware analysis. ## Description We are seeking a Principal Cyber Security Engineer with hands-on experience designing, deploying, and optimizing SIEM (Security Incident & Event Management) platforms at scale. The individual will own the end-to-end lifecycle of SIEM capability-from architecture and data onboarding to content engineering, automation, and continuous improvement. The individual will collaborate with SOC analysts, incident responders, threat hunters, IT operations, and application teams to ensure high-fidelity detections, actionable visibility, and reliable, compliant log management. The Work Itself * Design and maintain the SIEM architecture, including data ingestion pipelines, parsers, normalization schemas, storage tiers, and retention strategies. * Evaluate and implement SIEM platform features and integrations; drive upgrades and migrations as needed. * Onboard logs from diverse sources (EDR, firewalls, IDS/IPS, IAM, AD, DNS, proxies, email security, cloud platforms like AWS/Azure/GCP, SaaS apps, containers/Kubernetes, DBs, identity providers). * Implement data quality monitoring and SLA-driven dashboards for ingestion health, parser accuracy, and data latency. * Optimize SIEM performance: indexing, search speed, hot/warm/cold storage, retention, and cost control. * Implement role-based access control, multitenancy (if applicable), and data governance. * Ensure high availability and disaster recovery; document and test failover procedures. * Define KPIs/KRIs (e.g., MTTD, alert quality, data freshness, coverage, false positive rate). * Handle purple-team exercises and detection gap assessments; drive remediation. * Provide runbooks, knowledge base articles, and training to SOC and IT teams. * Align SIEM data handling with regulatory and contractual requirement (e.g., SOC 2, ISO 27001, PCI-DSS, HIPAA, GDPR). * Implement data minimization, masking, and retention policies, support audits and eDiscovery. * Partner with IT/Cloud/Data teams to implement logging at source and ensure secure, reliable transport. * Contribute to security architecture reviews for new systems and applications. ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [GitOps for the people](https://www.wearedevelopers.com/videos/461-gitops-for-the-people) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)