Senior SIEM Engineer — Threat Detection & SOC Automation

Andersen; Kraków; Sur place; PLN 120 000 - 180 000; Plein temps

Avantages offerts par ce poste

Private health insurance and sports

Certification compensation (AWS, PMP,等

Referral program

Corporate training portal access

Résumé du poste

Andersen is hiring a SIEM Administrator/Engineer to advance a multi-tenant SIEM platform, ensuring centralized security monitoring, threat detection, and reliable cyber defense. The role focuses on onboarding sources, tuning detections, and building SOAR integrations in a fast-paced environment with international clients.

Ideal candidates have 5+ years in IT or cybersecurity, 3+ years in production SIEM, and strong English.

Qualifications

• 5+ years in IT or cybersecurity
• 3+ years administering an enterprise SIEM in production
• Hands-on with at least one major SIEM (listed above)
• Experience onboarding log sources (Syslog, CEF, WEF, cloud connectors)
• Experience writing detection content in the platform's query language
• Understanding MITRE ATT&CK mapping
• Clean professional records; English level: upper-intermediate+

Responsabilités

• Administer, maintain and upgrade the SIEM platform (health, performance, capacity, licensing)
• Onboard and normalize new log sources in multi-tenant setups
• Develop, tune and maintain detection rules, correlations, dashboards and reports
• Reduce false positives with SOC analysts and implement new use cases
• Build and maintain SOAR playbooks and integrations
• Maintain documentation, data retention policies and access control
• Support audits and compliance reporting

Connaissances

SIEM administration

Threat detection

Log source onboarding

Detection content development

SOAR playbooks

Query languages (KQL/SPL/AQL)

MITRE ATT&CK mapping

English communication

Outils

Microsoft Sentinel

Splunk ES

IBM QRadar

Elastic Security

Description du poste

Andersen is hiring a SIEM Administrator/Engineer to advance a multi-tenant SIEM platform, ensuring centralized security monitoring, threat detection, and reliable cyber defense. The role focuses on onboarding sources, tuning detections, and building SOAR integrations in a fast-paced environment with international clients.

Ideal candidates have 5+ years in IT or cybersecurity, 3+ years in production SIEM, and strong English.