Senior SIEM Engineer | Hybrid | MS Sentinel Expert

EY; Málaga; Hybrid; EUR 70,000 - 90,000; Full time

Benefits offered by this job

Hybrid work model

Career development

Well-being programs

Volunteering opportunities

Recognition of performance

Job summary

EY GDS Spain in Malaga is seeking a Senior SIEM Engineer to design, integrate, and operate SIEM use cases in a Threat Detection & Response environment with a strong focus on Microsoft Sentinel and XDR.

You will onboard data sources, build analytics rules, and develop playbooks using Azure Logic Apps, while guiding stakeholders on security operations. Splunk or open-source SIEM experience is a plus, and a hybrid work model is offered.

Qualifications

• 2 - + 4 years of experience in SIEM engineering (design, onboarding, use case development, tuning, and operations), ideally with Microsoft Sentinel.
• Hands-on experience with Azure, Windows/Linux, and scripting (e.g., Python, PowerShell, Bash) as well as automation concepts.
• Experience building or operating SOAR-style automations (e.g., Logic Apps / playbooks) in a security operations context.
• English at least B2 (written and spoken) is required.

Responsibilities

• Integrate data sources into Microsoft Sentinel (cloud, identity, endpoint, network, and on-prem) and ensure data quality and normalization.
• Design, implement, and operate analytics rules, SIEM use cases, and hunting queries (KQL; SPL experience is a plus).
• Develop and maintain playbooks and automations using Azure Logic Apps to enrich, orchestrate, and standardize response workflows.
• Act as a technical SME for SIEM and Microsoft Sentinel/XDR solutions and provide hands-on guidance to stakeholders.
• Continuously optimize detection, response, and automation capabilities and contribute to engineering best practices.

Skills

SIEM engineering

Azure

Python

PowerShell

Bash

English (B2)

Tools

Microsoft Sentinel

Splunk

Elastic/ELK

Wazuh

Azure Logic Apps

Job description

EY GDS Spain in Malaga is seeking a Senior SIEM Engineer to design, integrate, and operate SIEM use cases in a Threat Detection & Response environment with a strong focus on Microsoft Sentinel and XDR.

You will onboard data sources, build analytics rules, and develop playbooks using Azure Logic Apps, while guiding stakeholders on security operations. Splunk or open-source SIEM experience is a plus, and a hybrid work model is offered.