> Markdown version of [/jobs/ext/4249387-siem-engineer](https://www.wearedevelopers.com/jobs/ext/4249387-siem-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # SIEM Engineer - **Company:** National Association of Insurance Commissioners - **Location:** Kansas City, KS, United States (Remote available) - **Experience:** Expert - **Salary:** $107,000.0 - $128,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Word, Microsoft Excel, Microsoft Windows, Amazon Web Services, Apple Mac Systems, JIRA, Microsoft Azure, Microsoft Outlook, Software as a Service, Cloud Computing Security, CompTIA Security+, Cyber Security, Data Normalization, Linux, Event Logging, Intrusion Detection and Prevention, Log Analysis, Microsoft Office, Parsing, Security Information and Event Management, Web Services, EndPointSecurity, Google Cloud, Data Ingestion, Mitre Att&ck, Cyber Threat Analysis, Information Technology, Cybercrime - **Published:** October 17, 2026 - **Apply:** https://www.careerbuilder.com/job-details/siem-engineer-kansas-city-ks--0420bf7a-5211-4cb9-ab04-abe85608c619 ## About the Role * Bachelor's degree from four-year college or university in a computer related field and 5+ years of experience in information security, with significant focus on security operations, or equivalent combination of education and technical experience. * Hands-on experience administering Google SecOps (Chronicle) or an equivalent enterprise SIEM platform. * Hands-on Experience with cloud security monitoring across AWS, Azure, or Google Cloud Platform. * Familiarity with security operations, threat hunting, and detection engineering practices. * Strong working knowledge of: + Security telemetry collection, log parsing, and data normalization + Threat detection, alert triage, and incident response + MITRE ATT&CK and modern adversary tactics, techniques, and procedures * Ability to communicate complex security concepts clearly to technical and non-technical audiences. * Familiarity with developing detection content using YARA-L and Unified Data Model (UDM) and investigating security incidents. * Hands-on experience with Endpoint Detection & Response (EDR/XDR) and Threat Intelligence Platforms. Preferred Experience * Experience with the Unified Data Model (UDM) and custom parser development. * Familiarity with the NIST Cybersecurity Framework. * Relevant certifications (e.g., CISSP, GCIH, GCIA, and Security+) * Experience with Google SecOps SOAR and playbook development * Experience managing and implementing OpenTelemtry Collectors. * Experience with Windows Event Logging and Sysmon. Systems & Technology Requirements * Slack * Atlassian Jira * Amazon Web Services (AWS) * Microsoft Azure * Windows, Linux, and MacOS Endpoints * Microsoft Suite (Outlook, Word, Excel, etc.), Applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time. ## Description Job Description:The Information Technology division of the National Association of Insurance Commissioners (NAIC) has an exciting opportunity for a SIEM Engineer. This position defines, implements, and maintains the organization's security monitoring and detection capabilities within the Google SecOps platform. Partners closely with Incident Response, and Security Architecture teams to ensure security telemetry is effectively collected, normalized, and monitored, enabling the detection, investigation, and response to cybersecurity threats across the enterprise. This is a full-time remote position. Residency within a 100-mile radius of the Kansas City, MO office is required.Responsibilities IncludeDesign, implement, and maintain the Google SecOps platform, including log ingestion, parsing, normalization, and enrichment across cloud, on-premises, SaaS, and security data sources.Onboard, validate and monitor new log sources within Google SecOps, ensuring proper mapping to the Unified Data Model (UDM) and maintaining telemetry coverage, parser performance, and platform health.Develop Google SecOps dashboards, operational metrics, and reporting to support security monitoring, compliance, audit, and executive reporting requirements.Develop and maintain automated investigation and response workflows using Google SecOps capabilities to streamline triage, enrichment, and response actions.Assist with the development, tuning, and maintenance of detection content using YARA-L, aligned to MITRE ATT&CK techniques, and continuously reduce false positives to improve detection fidelity.Minimum Education and/or Experience RequiredBachelor's degree from four-year college or university in a computer related field and 5+ years of experience in information security, with significant focus on security operations, or equivalent combination of education and technical experience.Hands-on experience administering Google SecOps (Chronicle) or an equivalent enterprise SIEM platform. Hands-on Experience with cloud security monitoring across AWS, Azure, or Google Cloud Platform. Familiarity with security operations, threat hunting, and detection engineering practices. Strong working knowledge of:Security telemetry collection, log parsing, and data normalizationThreat detection, alert triage, and incident responseMITRE ATT&CK and modern adversary tactics, techniques, and procedures Ability to communicate complex security concepts clearly to technical and non-technical audiences. Familiarity with developing detection content using YARA-L and Unified Data Model (UDM) and investigating security incidents. Hands-on experience with Endpoint Detection & Response (EDR/XDR) and Threat Intelligence Platforms.Preferred ExperienceExperience with the Unified Data Model (UDM) and custom parser development. Familiarity with the NIST Cybersecurity Framework. Relevant certifications (e.g., CISSP, GCIH, GCIA, and Security+)Experience with Google SecOps SOAR and playbook developmentExperience managing and implementing OpenTelemtry Collectors.Experience with Windows Event Logging and Sysmon.Systems & Technology RequirementsSlackAtlassian JiraAmazon Web Services (AWS)Microsoft AzureWindows, Linux, and MacOS Endpoints Microsoft Suite (Outlook, Word, Excel, etc.)TravelThis position does not require overnight business travel. Employees are responsible for their personal transportation to/from the home and office, including events, meetings, and training required by the NAIC.Compensation$107,000- $128,000, commensurate with education and experience. SponsorshipApplicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.Interested in learning more about the amazing benefits the NAIC offers? Visit our Benefits page for more information.The NAIC is proud to be an Equal Opportunity EmployerApplicants for all positions are considered without regard to age, race, creed, color, religion, sex, sexual orientation, gender identity or expression, national origin or ancestry, marital status, pregnancy, genetic information, military or veteran status, disability, or any other basis protected by applicable law. Job Description:The Information Technology division of the National Association of Insurance Commissioners (NAIC) has an exciting opportunity for a SIEM Engineer. This position defines, implements, and maintains the organization's security monitoring and detection capabilities within the Google SecOps platform. Partners closely with Incident Response, and Security Architecture teams to ensure security telemetry is effectively collected, normalized, and monitored, enabling the detection, investigation, and response to cybersecurity threats across the enterprise. This is a full-time remote position. Residency within a 100-mile radius of the Kansas City, MO office is required.Responsibilities IncludeDesign, implement, and maintain the Google SecOps platform, including log ingestion, parsing, normalization, and enrichment across cloud, on-premises, SaaS, and security data sources.Onboard, validate and monitor new log sources within Google SecOps, ensuring proper mapping to the Unified Data Model (UDM) and maintaining telemetry coverage, parser performance, and platform health.Develop Google SecOps dashboards, operational metrics, and reporting to support security monitoring, compliance, audit, and executive reporting requirements.Develop and maintain automated investigation and response workflows using Google SecOps capabilities to streamline triage, enrichment, and response actions.Assist with the development, tuning, and maintenance of detection content using YARA-L, aligned to MITRE ATT&CK techniques, and continuously reduce false positives to improve detection fidelity.Minimum Education and/or Experience RequiredBachelor's degree from four-year college or university in a computer related field and 5+ years of experience in information security, with significant focus on security operations, or equivalent combination of education and technical experience.Hands-on experience administering Google SecOps (Chronicle) or an equivalent enterprise SIEM platform. Hands-on Experience with cloud security monitoring across AWS, Azure, or Google Cloud Platform. Familiarity with security operations, threat hunting, and detection engineering practices. Strong working knowledge of:Security telemetry collection, log parsing, and data normalizationThreat detection, alert triage, and incident responseMITRE ATT&CK and modern adversary tactics, techniques, and procedures Ability to communicate complex security concepts clearly to technical and non-technical audiences. Familiarity with developing detection content using YARA-L and Unified Data Model (UDM) and investigating security incidents. Hands-on experience with Endpoint Detection & Response (EDR/XDR) and Threat Intelligence Platforms.Preferred ExperienceExperience with the Unified Data Model (UDM) and custom parser development. Familiarity with the NIST Cybersecurity Framework. Relevant certifications (e.g., CISSP, GCIH, GCIA, and Security+)Experience with Google SecOps SOAR and playbook developmentExperience managing and implementing OpenTelemtry Collectors.Experience with Windows Event Logging and Sysmon.Systems & Technology RequirementsSlackAtlassian JiraAmazon Web Services (AWS)Microsoft AzureWindows, Linux, and MacOS Endpoints Microsoft Suite (Outlook, Word, Excel, etc.)TravelThis position does not require overnight business travel. Employees are responsible for their personal transportation to/from the home and office, including events, meetings, and training required by the NAIC.Compensation$107,000- $128,000, commensurate with education and experience. SponsorshipApplicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.Interested in learning more about the amazing benefits the NAIC offers? Visit our Benefits page for more information.The NAIC is proud to be an Equal Opportunity EmployerApplicants for all positions are considered without regard to age, race, creed, color, religion, sex, sexual orientation, gender identity or expression, national origin or ancestry, marital status, pregnancy, genetic information, military or veteran status, disability, or any other basis protected by applicable law. The NAIC is proud to be an Equal Opportunity Employer Applicants for all positions are considered without regard to age, race, creed, color, religion, sex, sexual orientation, gender identity or expression, national origin or ancestry, marital status, pregnancy, genetic information, military or veteran status, disability, or any other basis protected by applicable law.