Senior Security Engineer (SIEM) - RDT Security Platforms

F. Hoffmann-La Roche AG; Madrid; On-site; EUR 90,000 - 140,000; Full time

Job summary

F. Hoffmann-La Roche AG Madrid is seeking a Senior Security Engineer to own and evolve our global Security Log Management and Vulnerability Scanning services. You will define roadmaps, architect solutions, and hands-on engineer to deliver reliable security data flows.

Ideal candidates bring deep SIEM experience, Python API integration, and DevOps fluency with Ansible and GitHub, plus interest in agentic AI and MCP to automate tasks and improve service quality.

Qualifications

• Deep understanding of SIEM/Log Management lifecycle (collection to searching).
• Strong Python skills and REST API integration.
• Experience with Ansible and GitHub for infra.
• Experience with agentic AI workflows or MCP is a plus.

Responsibilities

• Drive end-to-end lifecycle of Security Log Management and Security Scanning platforms.
• Ensure high availability and handle complex technical escalations.
• Develop API integrations between security scanning and logging.
• Lead data-tiering architecture for cost and performance optimization.
• Automate infrastructure via CI/CD pipelines (GitHub, Ansible, Python).
• Integrate AI Agents and MCP into daily operations.
• Mentor team on prompt engineering and AI ecosystems.
• Provide technical leadership and process improvements.
• Engage stakeholders across functions to align security goals.

Skills

SIEM lifecycle

Networking fundamentals

Python & APIs

DevOps tooling

Agentic AI workflows

Tools

Cribl

Splunk

Tenable

Job description

Senior Security Engineer

The Mission

You will be a key member of the SIEM team, contributing to the engineering and strategic evolution of our global Security Log Management and Vulnerability Scanning services. This is an end-to-end ownership role: from defining the roadmap and architectural strategy to hands-on engineering and operational excellence.

Key Responsibilities

• Service Ownership & Strategy: Drive the end-to-end lifecycle of our Security Log Management (Splunk & Cribl) and Security Scanning (Tenable) platforms.
• Service Reliability: Ensure high availability and performance of our security services globally, acting as an escalation point for complex technical challenges.
• System Interconnectivity: Develop and manage sophisticated API integrations to ensure seamless data flow between the security scanning (Tenable) and logging (Splunk/Cribl) tiers.
• Next-Gen Security Log Architecture: Drive the transition from a traditional "index-all" logging approach to a "data-tiering" mindset. Focus on cost optimization and performance across all data lifecycle phases: routing, filtering, storing and searching, ensuring security data is accessible and cost-effective.
• Infrastructure as Code (IaC): Orchestrate the evolution of our security infrastructure by managing all configurations via CI/CD pipelines (GitHub, Ansible, and Python), ensuring a fully automated and version-controlled environment.
• AI-Augmented Engineering: Actively integrate AI Agents and MCP (Model Context Protocol) servers into daily operations. Build agentic AI workflows to automate configuration, troubleshooting, and complex interconnectivity, while improving service offerings and user experience.
• Mentorship: Act as a technical catalyst for the team, mentoring colleagues in prompt engineering, agentic AI development, and advanced AI ecosystems.
• Technical Leadership: Serve as a technical lead, defining implementation plans and driving continuous process improvements.
• Stakeholder Engagement: Effectively manage relationships across functional teams, acting as a clear communicator and advisor to ensure alignment on security goals and project delivery.

Technical Requirements & Expertise

• Security Service Depth: Deep conceptual understanding of the SIEM/Log Management lifecycle (Collection, Indexing, Storage, Retention and Searching) and Vulnerability Management.
• Networking Fundamentals: Expert understanding of networking (TCP/IP, Load Balancing, Firewalls) as it relates to high-volume security data transport.
• Coding & API Mastery: Strong experience with Python and interacting with complex REST APIs. Proven ability to interconnect disparate technologies via APIs and custom integrations.
• Modern DevOps: Strong experience with Ansible and GitHub for managing infrastructure.
• Advanced AI/Automation: Proven experience or deep project work building Agentic AI workflows. Practical expertise in MCP (Model Context Protocol) or building custom LLM-based tools to automate technical tasks.

Tooling (Preferred)

• Experience with Cribl, Splunk, or Tenable is a plus, but the ability to rapidly upscale and automate these via AI is essential.

Equal Opportunity Statement

Roche is an Equal Opportunity Employer. We believe it’s urgent to deliver medical solutions right now – even as we develop innovations for the future.