Hybrid SIEM Engineer - Elasticsearch & Threat Detection

BT Group; Birmingham; Hybrid; GBP 65,000 - 90,000; Full time

Benefits offered by this job

10% on target annual bonus

Private GP 24/7 for you and family

Market-leading pension scheme

Job summary

BT Group in Birmingham is seeking a SIEM Application Engineer to support the development, deployment and operation of BT's strategic SIEM. You will design and maintain ingestion pipelines using Elasticsearch, Logstash and Kibana, and work with Kafka sources.

The role requires a solid software engineering background, scripting, and hands-on experience with Kubernetes and DevOps tools. Based in the Birmingham office, it is a hybrid role with three days in the office.

Qualifications

• The candidate must have a software engineering background with security focus.
• Proven experience with SIEM components and security logging/monitoring.
• Hands-on knowledge of Elasticsearch, Logstash and Kibana in production.
• Experience integrating data from Kafka sources and threat intel feeds.
• Familiarity with Kubernetes and DevOps pipelines (ArgoCD, Gitlab).
• Strong problem solving and attention to detail; quick learner.

Responsibilities

• Data ingestion and enrichment via Elasticsearch pipelines and Kafka sources.
• Develop SIEM solutions in collaboration with security analysts and architects.
• Optimize SIEM rules, alerts and dashboards for threat detection.
• Write efficient Elasticsearch queries and tune performance.
• Maintain SIEM infrastructure and monitor reliability and security.
• Collaborate on security engineering projects and incident response.

Skills

Software Engineering

Scripting

Kubernetes

Elasticsearch

Kafka

ArgoCD

Gitlab pipelines

YAML

Helm

Ansible

Basic networking

Troubleshooting

Willingness to learn

Attention to detail

Tools

Elasticsearch

Logstash

Kibana

Kafka

ArgoCD

Gitlab pipelines

YAML

Helm

Ansible

Linux

Windows

Job description

BT Group in Birmingham is seeking a SIEM Application Engineer to support the development, deployment and operation of BT's strategic SIEM. You will design and maintain ingestion pipelines using Elasticsearch, Logstash and Kibana, and work with Kafka sources.

The role requires a solid software engineering background, scripting, and hands-on experience with Kubernetes and DevOps tools. Based in the Birmingham office, it is a hybrid role with three days in the office.