SIEM Admin & Engineer — Threat Detection

Andersen Lab; Kraków; On-site; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Private health insurance

Sports compensation

Mentoring program

Corporate training portal

Referral program

Job summary

Andersen is seeking an experienced SIEM Administrator/Engineer to enhance a SIEM platform and support centralized security monitoring and threat detection. The role involves onboarding log sources, developing detection rules, and building SOAR playbooks within a multi-tenant environment.

Required hands-on SIEM experience (3+ years in production) and proficiency with leading platforms; English at Upper-Intermediate level or higher; background verification will be conducted.

Qualifications

• 5+ years IT/cybersecurity experience.
• 3+ years administering an enterprise SIEM in production.
• Experience with major SIEM platforms (Microsoft Sentinel, Splunk ES, IBM QRadar, Elastic Security).
• Hands-on log source onboarding, parsing and normalization (Syslog, CEF, WEF, API connectors).
• Experience writing detection content in the platform query language (KQL, SPL, AQL).
• Understanding of MITRE ATT&CK mapping for coverage.
• Clean professional records and willingness to undergo background verification.
• Level of English – Upper-Intermediate and above.

Responsibilities

• Administering, maintaining and upgrading the SIEM platform, including health, performance, capacity and licensing.
• Onboarding and normalizing new log sources in multi-tenant setups.
• Developing, tuning and maintaining detection rules, correlation searches, dashboards and reports.
• Reducing false positives with SOC analysts and implementing new use cases.
• Building and maintaining SOAR playbooks and integrations.
• Maintaining documentation, data retention policies and access control.
• Supporting audits and compliance reporting.

Skills

SIEM administration

Threat detection

Log onboarding

Detection content

KQL/SPL/AQL

MITRE ATT&CK

English proficiency

Tools

Syslog

CEF

Windows Event Forwarding

APIs/log connectors

Job description

Andersen is seeking an experienced SIEM Administrator/Engineer to enhance a SIEM platform and support centralized security monitoring and threat detection. The role involves onboarding log sources, developing detection rules, and building SOAR playbooks within a multi-tenant environment.

Required hands-on SIEM experience (3+ years in production) and proficiency with leading platforms; English at Upper-Intermediate level or higher; background verification will be conducted.