Senior SIEM Engineer - QRadar and Microsoft Sentinel

DiceTek UAE; Abu Dhabi; On-site; AED 240,000 - 480,000; Full time

Job summary

DiceTek UAE is seeking an experienced Senior SIEM Engineer for IBM QRadar and Microsoft Sentinel in Abu Dhabi, United Arab Emirates. The role requires hands-on deployment, configuration and ongoing support of enterprise SIEM environments to enhance threat detection and security monitoring.

The candidate will work across QRadar and Sentinel, develop detections using MITRE ATT&CK concepts, build SOAR playbooks, and ensure reliable data pipelines and integration with Azure security services in a

Qualifications

• 5+ years in security operations, SIEM engineering or related cybersecurity roles.
• Hands-on experience deploying and configuring IBM QRadar.
• Strong experience implementing and supporting Microsoft Sentinel.
• Experience with SIEM data ingestion, parsing, analytics and detection.

Responsibilities

• Deploy and configure QRadar SIEM environments.
• Configure DSMs for log ingestion and parsing.
• Develop and maintain custom properties for event data.
• Configure correlation rules and reference data.
• Design and configure Microsoft Sentinel workspaces.
• Develop analytics rules and Sentinel workbooks.
• Build and maintain SOAR playbooks and automation.
• Integrate with Azure Monitor and DCRs.
• Apply MITRE ATT&CK concepts to detection engineering.
• Troubleshoot log ingestion and data pipelines.

Skills

QRadar

Microsoft Sentinel

SIEM engineering

Threat detection

Tools

QRadar DSMs

KQL

Job description

Senior SIEM Engineer - QRadar and Microsoft Sentinel Job Snapshot: Role: Senior SIEM Engineer - QRadar and Microsoft Sentinel - Location: Abu Dhabi, United Arab Emirates - Industry: Banking - Function: Computer-Network Security - Experience: 5-10 years in security operations, SIEM engineering or a related cybersecurity role - Job Type: Full Time - Work Arrangement: On-site - Gender: No Preference - Candidate Nationality: Not specified - Salary: Not disclosed.

Position Overview: Dicetek LLC is seeking an experienced SIEM Engineer with strong hands-on expertise in IBM QRadar and Microsoft Sentinel for a full-time, on-site opportunity in Abu Dhabi, United Arab Emirates. The role requires practical experience deploying, configuring and supporting enterprise Security Information and Event Management (SIEM) platforms. The successful candidate will work with security log ingestion, detection engineering, analytics rules, automation playbooks and security monitoring integrations.

Core Technical Responsibilities

IBM QRadar Engineering

• Deploy and configure IBM QRadar SIEM environments.
• Configure Device Support Modules (DSMs) for security log ingestion and parsing.
• Develop and maintain custom properties for extracting relevant security event information.
• Configure correlation rules to support threat detection.
• Manage reference data used in security monitoring and correlation.
• Configure and support QRadar applications.
• Investigate log parsing, normalisation and event processing issues.
• Troubleshoot QRadar configuration and detection-related problems.

Microsoft Sentinel Engineering

• Design and configure Microsoft Sentinel workspaces.
• Implement and maintain security data connectors.
• Develop and manage analytics rules for threat detection.
• Create and maintain Sentinel workbooks for security monitoring and reporting.
• Configure automation capabilities and associated security workflows.
• Support integration with relevant Microsoft security services.
• Investigate data ingestion, detection and automation issues.
• Maintain reliable Sentinel configurations and security monitoring capabilities.

Security Detection Engineering

• Develop and maintain security detection logic using KQL.
• Apply AQL when investigating or developing relevant QRadar queries.
• Use MITRE ATT&CK techniques to inform detection engineering activities.
• Analyse security events and identify opportunities to improve threat detection.
• Review detection rules for accuracy and operational effectiveness.
• Investigate false positives and detection gaps.
• Support consistent detection coverage across integrated log sources.
• Maintain documentation for detection rules and associated security use cases.

Security Log Ingestion and Data Pipelines

• Configure and troubleshoot security log ingestion from enterprise systems.
• Work with Syslog and Common Event Format (CEF) data sources.
• Configure relevant Azure Monitor Agent (AMA) integrations.
• Apply Data Collection Rules (DCRs) for supported Microsoft monitoring requirements.
• Integrate security events through APIs where appropriate.
• Investigate log parsing and normalisation issues.
• Validate that ingested security data supports intended monitoring and detection requirements.
• Troubleshoot data pipeline failures affecting SIEM visibility.

SOAR and Security Automation

• Build and maintain Security Orchestration, Automation and Response (SOAR) playbooks.
• Develop security automation workflows supporting monitoring and response activities.
• Integrate automation with relevant security tools and services.
• Use PowerShell or Python to support scripting and automation requirements.
• Troubleshoot automation failures and integration issues.
• Validate playbook behaviour and operational effectiveness.

Microsoft Security Ecosystem Integration

• Work with Microsoft Azure security capabilities.
• Support integrations involving Microsoft Defender XDR.
• Apply working knowledge of Microsoft Entra ID.
• Configure relevant identity and security event data sources.
• Support security monitoring across connected Microsoft environments.
• Investigate integration issues affecting security visibility and detection.

Required Experience

• 5-10 years of experience in security operations, SIEM engineering or a related cybersecurity role.
• Proven hands-on experience deploying and configuring IBM QRadar.
• Strong practical experience implementing and supporting Microsoft Sentinel.
• Experience configuring SIEM data ingestion, parsing, analytics and detection capabilities.
• Practical experience developing security automation and SOAR playbooks.
• Knowledge of security log sources, normalisation and data pipelines.
• Experience applying MITRE ATT&CK concepts to security detection engineering.
• Working knowledge of Microsoft Azure, Defender XDR and Entra ID.
• Ability to develop scripts using PowerShell and/or Python.

Essential Technical Skills

IBM QRadar

• QRadar deployment and configuration.
• Device Support Module configuration.
• Custom property development.
• Correlation rule configuration.
• Reference data management.
• QRadar application configuration.
• Ariel Query Language.
• Log parsing and normalisation.

Microsoft Sentinel

• Sentinel workspace design.
• Data connector configuration.
• Analytics rule development.
• Sentinel workbooks.
• Security automation.
• Kusto Query Language.
• Azure Monitor Agent.
• Data Collection Rules.

Security Monitoring and Detection

• SIEM engineering.
• Security log ingestion.
• Threat detection engineering.
• MITRE ATT&CK.
• Security event correlation.
• Detection rule tuning.
• Log normalisation.
• Security data pipeline troubleshooting.

Automation and Scripting

• SOAR playbook development.
• Security workflow automation.
• PowerShell scripting.
• Python scripting.
• API-based security integrations.

Cloud and Identity Security

• Microsoft Azure.
• Microsoft Defender XDR.
• Microsoft Entra ID.
• Cloud security event monitoring.
• Identity-related security telemetry.

Highly Desirable Experience

SIEM Migration

• Experience migrating security monitoring capabilities from IBM QRadar to Microsoft Sentinel.
• Understanding of technical considerations associated with SIEM platform transitions.
• Experience adapting detection content, log integrations and monitoring configurations during migration activities.

Banking and Regulatory Security Monitoring

• Experience working within banking or financial services.
• Familiarity with Central Bank of the UAE (CBUAE) security monitoring expectations.
• Knowledge of Payment Card Industry Data Security Standard (PCI DSS) requirements.
• Familiarity with the SWIFT Customer Security Programme (CSP).
• Experience supporting security monitoring within regulated technology environments.

Enterprise SOC Environments

• Experience supporting large-scale security monitoring operations.
• Familiarity with regulated enterprise environments.
• Experience working with 24/7 Security Operations Centres.
• Understanding of operational requirements for continuous security monitoring.

Infrastructure as Code and CI/CD

• Experience deploying or managing Microsoft Sentinel configurations using Infrastructure as Code.
• Familiarity with Azure Resource Manager (ARM) templates.
• Knowledge of Bicep or Terraform.
• Experience applying CI/CD practices to security detection content.

Security Technology Integrations

• Experience integrating threat intelligence platforms.
• Experience integrating Endpoint Detection and Response (EDR) tools.
• Understanding of security telemetry and integration requirements.

Preferred Professional Certifications

The following certifications are preferred:

• Microsoft Certified: Security Operations Analyst Associate (SC-200).
• IBM Certified QRadar SIEM Administrator or Deployment Professional.
• GIAC Certified Intrusion Analyst (GCIA).
• GIAC Certified Incident Handler (GCIH).
• GIAC Certified Detection Analyst (GCDA).
• Certified Information Systems Security Professional (CISSP).
• Equivalent relevant cybersecurity certifications.

These certifications are preferred rather than mandatory.

Professional Competencies

• Strong technical troubleshooting and analytical skills.
• Ability to investigate complex SIEM configuration and data ingestion issues.
• Practical understanding of enterprise security monitoring requirements.
• Strong detection engineering and query development capabilities.
• Ability to work with security automation and integrated monitoring technologies.
• Attention to security event accuracy, parsing and normalisation.
• Ability to document technical configurations and detection logic clearly.
• Understanding of operational requirements within large or regulated SOC environments.

Role Expectations

The Senior SIEM Engineer will contribute to enterprise security monitoring through hands-on engineering of IBM QRadar and Microsoft Sentinel. The successful candidate will demonstrate strong expertise in SIEM configuration, KQL-based detection engineering, security log integration and SOAR automation. Experience with QRadar-to-Sentinel migration, banking security monitoring requirements and infrastructure-as-code deployment practices will be particularly valuable. The role requires a technically capable cybersecurity professional who can support reliable security telemetry, effective threat detection and automation across enterprise monitoring environments.