Security Engineer

VIQU Limited; City Of London; Hybrid; GBP 92,000 - 129,000; Full time

Job summary

VIQU Limited is seeking a hands-on Security Engineer to own and optimise IBM QRadar SIEM rules, correlation logic and alert tuning. The role includes log aggregation and preparation for a potential migration to Splunk, with one day per week onsite in Central London and remote work options.

The ideal candidate will have strong QRadar experience, knowledge of log normalization, and a track record of improving threat detection within a SOC environment.

Qualifications

• Hands-on experience with IBM QRadar SIEM.
• Proficient in developing and tuning SIEM rules.
• Strong understanding of log sources and event normalization.
• Experience with log aggregation and forwarding tech.
• Experience working with SOC teams.

Responsibilities

• Own, maintain and tune IBM QRadar SIEM rules, correlation logic and alerts.
• Review and optimise detection use cases to reduce false positives.
• Configure and maintain log collection, parsing, normalisation and aggregation.
• Support log aggregation using Fluentd, Cribl or similar technologies.
• Ensure relevant security logs are ingested for the third-party SOC.
• Troubleshoot log ingestion, parsing and SIEM detection issues.
• Identify opportunities to improve SIEM coverage and logging quality.
• Support planning for migration from QRadar to Splunk.

Skills

QRadar SIEM

SIEM rule tuning

Log aggregation

SOC collaboration

Threat detection

Tools

Fluentd

Cribl

Fluent Bit

Python

Job description

Security Engineer - SIEM / QRadar - 6-month contract - London/remote

Overview

My Client is seeking a hands-on Security Engineer to own and optimise SIEM rules, alert tuning and log aggregation, primarily within IBM QRadar. The role will focus on improving threat detection and ensuring high-quality security logs are available to a third-party SOC. There may also be an opportunity to support a future migration to Splunk.

Key Responsibilities of the Security Engineer

• Own, maintain and tune IBM QRadar SIEM rules, correlation logic and alerts.
• Review and optimise detection use cases to improve threat visibility and reduce false positives.
• Configure and maintain log collection, parsing, normalisation and aggregation.
• Support log aggregation using Fluentd, Cribl or similar technologies.
• Ensure relevant security logs are accurately ingested and available to the third-party SOC.
• Troubleshoot log ingestion, parsing and SIEM detection issues.
• Identify opportunities to improve SIEM coverage, logging quality and detection capabilities.
• Support planning and potential migration from QRadar to Splunk.

Essential Skills & Experience from the Security Engineer

• Strong hands-on experience with IBM QRadar SIEM.
• Experience developing, maintaining and tuning SIEM rules and correlation searches.
• Good understanding of security logging, log sources and event normalisation.
• Experience with log aggregation and forwarding technologies.
• Experience working with SOC teams and supporting security monitoring operations.

Desirable Skills from the Security Engineer

• Experience with Fluentd, Cribl or Fluent Bit.
• Exposure to Splunk SIEM and migration projects.
• Scripting experience using Python, Bash or similar.
• Experience onboarding new log sources and troubleshooting ingestion pipelines.

The Security Engineer is required 1 day a week onsite in Central London.