Remote SIEM Engineer: QRadar Expert, Splunk Migration Ready

VIQU IT; Greater London; Híbrido; GBP 65.000 - 95.000; Jornada completa

Descripción de la vacante

VIQU IT in London is seeking a hands-on Security Engineer to own and optimise SIEM rules, alert tuning and log aggregation, primarily within IBM QRadar. The role offers a hybrid setup with one day on-site per week and may support a future migration to Splunk.

You will collaborate with the SOC, tune detections to improve threat visibility and reduce false positives, and help configure log sources and parsing.

Formación

• Strong hands-on experience with IBM QRadar SIEM.
• Experience developing, maintaining and tuning SIEM rules and correlation searches.
• Good understanding of security logging, log sources and event normalisation.
• Experience with log aggregation and forwarding technologies.
• Experience working with SOC teams and supporting security monitoring operations.

Responsabilidades

• Own, maintain and tune IBM QRadar SIEM rules, correlation logic and alerts.
• Review and optimise detection use cases to improve threat visibility and reduce false positives.
• Configure and maintain log collection, parsing, normalisation and aggregation.
• Support log aggregation using Fluentd, Cribl or similar technologies.
• Ensure relevant security logs are ingested and available to the third-party SOC.
• Troubleshoot log ingestion, parsing and SIEM detection issues.
• Identify opportunities to improve SIEM coverage, logging quality and detection capabilities.
• Support planning and potential migration from QRadar to Splunk.

Conocimientos

QRadar SIEM

SIEM rule tuning

Log aggregation

SOC collaboration

Python scripting

Bash scripting

Fluentd

Cribl

Splunk exposure

Herramientas

Splunk

Descripción del empleo

VIQU IT in London is seeking a hands-on Security Engineer to own and optimise SIEM rules, alert tuning and log aggregation, primarily within IBM QRadar. The role offers a hybrid setup with one day on-site per week and may support a future migration to Splunk.

You will collaborate with the SOC, tune detections to improve threat visibility and reduce false positives, and help configure log sources and parsing.