SIEM Monitoring Engineer - Build & Run Centralized Detection

Bosal; Santiago de Querétaro; On-site; MXN 600,000 - 900,000; Full time

Job summary

BOSAL is seeking a SIEM Monitoring Engineer in Querétaro, Mexico, to build and operate centralized security monitoring and incident detection capabilities. You will design and implement a SIEM platform from scratch, ensuring effective detection and response across the IT landscape.

You will onboard logs from Palo Alto firewalls, Cisco devices, Windows/Linux servers, cloud services, and identity platforms; develop detection rules; document incident response workflows; and continuously improve

Qualifications

• 4+ years in security operations or SOC roles.
• Experience building or extending SIEM platforms.
• Experience with incident response processes.
• Experience with Windows logging.
• Experience with Linux logging.
• Knowledge of network and firewall logging concepts.
• Relevant certifications are considered assets.

Responsibilities

• Design, build and operate a SIEM platform (e.g., Microsoft Sentinel or equivalent).
• Onboard and normalize logs from various sources (firewalls, switches, servers, SaaS apps).
• Define, prioritize and maintain detection use cases aligned with risk.
• Develop and maintain detection rules and use cases.
• Design and document incident response workflows and playbooks.
• Correlate incidents with asset criticality and vulnerability data.
• Support TISAX evidence for monitoring, logging and incident handling.
• Continuously improve detection coverage and reduce false positives.
• Ensure monitoring and incident response are audit-ready.

Skills

SIEM platforms (Sentinel, Splunk)

Log ingestion & parsing

Security monitoring & detection

Windows logging

Linux logging

Network & firewall logging

Certifications as asset

Tools

Sentinel

Splunk

Job description

BOSAL is seeking a SIEM Monitoring Engineer in Querétaro, Mexico, to build and operate centralized security monitoring and incident detection capabilities. You will design and implement a SIEM platform from scratch, ensuring effective detection and response across the IT landscape.

You will onboard logs from Palo Alto firewalls, Cisco devices, Windows/Linux servers, cloud services, and identity platforms; develop detection rules; document incident response workflows; and continuously improve