SIEM Engineer: Build & Elevate Threat Detection

Bosal; Santiago de Querétaro; Presencial; MXN 600.000 - 900.000; Jornada completa

Descripción de la vacante

BOSAL is seeking a Security Monitoring Engineer in Querétaro, Mexico, to build and operate centralized security monitoring and incident detection capabilities. You will design a SIEM platform from scratch and ensure effective detection and response across the organization’s IT landscape.

You will onboard diverse log sources, define detection use cases, develop detection rules, and document incident response workflows.

Formación

• 4+ years in security operations or SOC-related roles.
• Experience building or significantly extending SIEM platforms.
• Experience with incident response processes.
• Relevant certifications are considered as an asset.

Responsabilidades

• Design, implement, and operate a SIEM platform from scratch.
• Onboard and normalize logs from Palo Alto firewalls, Prisma Access, Cisco switches, WLCs, ISE, Catalyst Center, Windows and Linux servers, Microsoft 365, and identity services.
• Define, prioritize and maintain detection use cases aligned with asset criticality and risk.
• Develop and maintain detection rules and use cases.
• Design and document incident response workflows and playbooks.
• Correlate incidents with asset criticality and vulnerability data.
• Support TISAX evidence for monitoring and incident handling.
• Continuously improve detection coverage and reduce false positives.
• Ensure monitoring and incident response capabilities are audit-ready.

Conocimientos

SIEM platforms

Log ingestion & parsing

Security monitoring

Windows logging

Linux logging

Network & firewall logging

Certifications asset

Herramientas

Sentinel

Splunk

Syslog

APIs & log formats

Descripción del empleo

BOSAL is seeking a Security Monitoring Engineer in Querétaro, Mexico, to build and operate centralized security monitoring and incident detection capabilities. You will design a SIEM platform from scratch and ensure effective detection and response across the organization’s IT landscape.

You will onboard diverse log sources, define detection use cases, develop detection rules, and document incident response workflows.