SIEM Engineer

We are seeking an experienced SIEM Engineer to provide hands-on engineering support for its enterprise Security Information and Event Management (SIEM) environment.

The selected candidate will be responsible for designing, configuring, integrating, maintaining, and optimizing SIEM capabilities to strengthen security monitoring, threat detection, incident response, and enterprise log management.

This is a hands-on technical engineering position reporting to the Director. Strategic direction, governance, and overall program oversight will be managed by the Director., * Engineer, configure, maintain, and optimize the enterprise SIEM platform, primarily Splunk and related security technologies.

• Onboard new data sources and manage log collection, parsing, normalization, indexing, and retention.
• Develop and maintain correlation searches, detection rules, alerts, dashboards, reports, and security monitoring content.
• Integrate SIEM solutions with cloud platforms, enterprise applications, infrastructure, and security tools.
• Monitor SIEM platform performance, capacity, availability, and overall system health.
• Troubleshoot technical issues and optimize platform performance and reliability.
• Tune alerts and detection logic to reduce false positives and improve threat detection effectiveness.
• Support SOC analysts and incident response teams with queries, dashboards, and investigation capabilities.
• Support SIEM upgrades, patches, configuration changes, testing, and infrastructure implementation.
• Maintain technical documentation, system configurations, operational procedures, and knowledge-transfer materials.
• Collaborate with SOC, infrastructure, cloud, networking, and application teams.
• Follow Commonwealth security standards, change-management procedures, and applicable cybersecurity policies.

• Strong hands-on experience with Splunk and enterprise SIEM engineering.
• Experience with log ingestion, parsing, normalization, indexing, and retention.
• Proficiency in developing correlation searches, alerts, detection rules, dashboards, and reports.
• Experience integrating SIEM platforms with cloud environments, infrastructure, applications, and security technologies.
• Strong troubleshooting, performance optimization, and alert-tuning capabilities.
• Experience supporting Security Operations Center (SOC) operations, threat detection, and incident response.
• Knowledge of security event analysis, log management, and security monitoring best practices.
• Strong technical documentation, problem-solving, and cross-functional communication skills., The ideal candidate is a hands-on SIEM Engineer with strong Splunk expertise and experience managing enterprise-scale security monitoring environments. The candidate should be capable of independently handling SIEM configuration, data-source onboarding, detection engineering, troubleshooting, and performance optimization while collaborating with SOC and infrastructure teams.

Candidates with direct experience in Splunk engineering, enterprise log management, detection content development, and production SIEM operations should be prioritized.