Remote SIEM Engineer - Security Analytics & Onboarding

SII Group Switzerland; Bezirk Olten; Vor Ort; CHF 110.000 - 170.000; Vollzeit

Zusammenfassung

SII Group Switzerland is seeking an IT SIEM Engineer to design, deploy, and operate monitoring for critical IT environments. You will onboard logs, build data pipelines, and ensure reliable security visibility across identity, endpoints, cloud, and applications.

Ideal candidates have hands-on SIEM experience with MS Sentinel, Splunk, or QRadar, plus scripting skills and strong English. The role emphasizes collaboration across IT, security, and cloud teams in a global setup.

Qualifikationen

• Practical experience in SIEM engineering, security monitoring, log management, or security platform engineering.
• Hands-on experience with enterprise SIEMs, preferably Microsoft Sentinel; Splunk, QRadar, Elastic, or Google SecOps also relevant.
• Experience onboarding and troubleshooting logs across Windows, Linux, Entra ID, cloud, network, endpoint, and application environments.
• Proficiency in KQL, SPL, SQL, or similar query languages, with analytics and performance troubleshooting.
• Knowledge of syslog, APIs, agents, collectors, event streaming, parsing, normalization, and enrichment.
• Scripting/automation skills with PowerShell, Python, REST APIs, Git, CI/CD, or IaC.
• Understanding of detection engineering, incident response, forensics, networking, security controls, and data protection.
• Strong analytical, documentation, communication, and ownership skills; professional English required.
• Knowledge of SIEM/data lake architecture, SOAR, detection-as-code, and regulated/critical infrastructure or OT environments.

Aufgaben

• Engineer, configure, maintain, and monitor the SIEM platform, collectors, connectors, and supporting infrastructure.
• Onboard security-relevant logs from identity, endpoint, network, cloud, business applications, databases, and other environments.
• Design reliable data pipelines; develop parsing, normalization, transformation, timestamp handling, and contextual enrichment.
• Monitor telemetry health and resolve missing sources, ingestion delays, volume anomalies, schema changes, and connector failures.
• Support detection engineering with required fields, correlation logic, threat intelligence, MITRE ATT&CK mapping, and testing.
• Optimize ingestion, storage tiers, retention, query performance, licensing, and cost without reducing required security visibility.
• Maintain architecture diagrams, log-source inventory, onboarding standards, runbooks, ownership, and configuration records.
• Support SOC investigations, threat hunting, incident response, forensic data extraction, audits, and major incident resolution.
• Coordinate logging requirements and remediation with IT, Cloud, Network, IAM, Application, OT, vendors, and service providers.

Kenntnisse

SIEM engineering

Security monitoring

Log management

Microsoft Sentinel

Splunk

QRadar

Elastic

Query languages

Scripting: PowerShell

Python

REST APIs

Git/CI/CD/IaC

English communication

Tools

Microsoft Sentinel

Splunk

QRadar

Elastic

Google SecOps

Jobbeschreibung

SII Group Switzerland is seeking an IT SIEM Engineer to design, deploy, and operate monitoring for critical IT environments. You will onboard logs, build data pipelines, and ensure reliable security visibility across identity, endpoints, cloud, and applications.

Ideal candidates have hands-on SIEM experience with MS Sentinel, Splunk, or QRadar, plus scripting skills and strong English. The role emphasizes collaboration across IT, security, and cloud teams in a global setup.