Security Engineer - SIEM (QRadar) | Remote/Hybrid Contract

VIQU IT; City Of London; Hybrid; GBP 101,000 - 138,000; Full time

Benefits offered by this job

Referral bonus (up to £1,000)

Job summary

VIQU IT is seeking a hands-on Security Engineer to own IBM QRadar SIEM rules, correlation logic, log collection and normalization, primarily in London with remote options.

You will tune detections, reduce false positives, support log forwarding using Fluentd/Cribl, and assist migration to Splunk. The role requires collaboration with the SOC and monitoring teams, with onsite one day per week in Central London.

Qualifications

• Hands-on experience with IBM QRadar SIEM
• Experience developing, maintaining and tuning SIEM rules
• Understanding of security logging, log sources and normalization
• Experience with log aggregation and forwarding technologies
• Experience working with SOC monitoring operations

Responsibilities

• Own, maintain and tune IBM QRadar SIEM rules, correlation logic and alerts.
• Review and optimise detection use cases to improve threat visibility and reduce false positives.
• Configure and maintain log collection, parsing, normalisation and aggregation.
• Support log aggregation using Fluentd, Cribl or similar technologies.
• Ensure relevant security logs are ingested and available to the SOC.
• Troubleshoot log ingestion, parsing and SIEM detection issues.
• Identify opportunities to improve SIEM coverage and detection capabilities.
• Support planning and potential migration from QRadar to Splunk.

Skills

IBM QRadar SIEM

SIEM rule tuning

Log normalization

Log aggregation

SOC collaboration

Python/Bash scripting

Tools

Fluentd

Cribl

Fluent Bit

Splunk

Job description

VIQU IT is seeking a hands-on Security Engineer to own IBM QRadar SIEM rules, correlation logic, log collection and normalization, primarily in London with remote options.

You will tune detections, reduce false positives, support log forwarding using Fluentd/Cribl, and assist migration to Splunk. The role requires collaboration with the SOC and monitoring teams, with onsite one day per week in Central London.