SIEM Management

The SIEM Engineer will manage and optimize enterprise SIEM platforms, supporting security monitoring, log management, threat detection, and incident response across on-premises and cloud environments. The role requires hands-on experience with SIEM deployment, security tool integrations, log onboarding, detection rules, and cloud security monitoring, along with strong troubleshooting and analytical skills.

• Designing, reviewing, implementing, testing, maintaining, and troubleshooting SIEM deployments and infrastructures.

• Responsible for managing arrangements of dependencies and pre-requisites for SIEM projects e.g., connectivity, storage, licenses, and other equipment).

• Responsible for implementing changes to the SIEM infrastructure (including patches, updates, and upgrades) and performing SIEM Health Checks; and for creating technically relevant detailed reports to track solution effectiveness and performance.

• Manage SIEM Appliance or Virtual Appliance (including OS and SIEM software).

• Configure backups, verify custom reports, manage log source groups, and validate log sources.

• Manage SIEM user accounts (create, delete, modify, etc.).

• Add /Remove log sources. Troubleshoot issues with log sources or systems with system owners and vendors, and report system defects and product enhancement / feature requests with vendors as needed.

• Be responsible for development of integrations, connectors, and parsers for new event sources

• Implementing security monitoring rules in a SIEM tooling, according to the business needs

• Assist with fully optimizing the SIEM system capabilities and identifying opportunities for automation to improve SIEM effectiveness and efficiency.

• Create rules and reports for compliance and audit requirements and create and manage Watch Lists for current threats.

• Create engineering and security documentation for internal and external needs including high level and low-level design of SIEM infrastructure, as-built documentation and documentation for custom connectors/parsers and integrations.

• Assist with designing and documenting work processes within the SOC.

• Responsible for mentoring and training of Junior SIEM Engineers.

• Perform other duties as assigned.

Experience:

• Minimum 5 years of experience in Security Engineering, including at least 3 years of hands-on experience managing SIEM solutions.

Educational Qualifications:

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field.

Required Skills:

• Proven experience in designing and implementing SIEM solutions.

• Hands-on experience integrating security tools such as AV, AAA, Firewalls, DLP, and IDS/IPS with SIEM platforms.

• Experience implementing SIEM monitoring across cloud environments, including:
• AWS: CloudTrail, GuardDuty, VPC Flow Logs

• Azure: Activity Logs, Entra ID Sign-in Logs, Microsoft Defender for Cloud

• GCP: Cloud Audit Logs, VPC Flow Logs

• OCI: Audit Logs, Cloud Guard

• Strong hands-on experience with SIEM technologies such as Splunk, Microsoft Sentinel, and Google SecOps.

• Good understanding of Information Security regulations, frameworks, and requirements, with the ability to map security needs to appropriate SIEM solutions.

• Solid understanding of Information Security and Networking.

• Experience with scripting and query languages for SIEM data onboarding, such as Python, Regex, SPL, and KQL.

• Strong analytical, troubleshooting, and problem-solving skills, with a focus on identifying and addressing root causes.

• Excellent time management, organizational, and prioritization skills, with the ability to manage multiple stakeholders and competing priorities.

• Strong written and verbal communication skills, with the ability to explain complex technical concepts to non-technical stakeholders.

• Ability to work on-call, including nights and weekends, when required.

• Ability to work effectively in a high-demand, customer-focused environment and deliver quality results within agreed timelines.

Desirable:

• Regional experience and familiarity with the Middle East.

• Experience working within an MSSP or MDR environment.

• Experience deploying and administering multiple SIEM technologies.

• Relevant certifications in Splunk, Microsoft Sentinel, Google SecOps, or other SIEM technologies.