SIEM Security Operations Engineer - Sentinel Onboarding

HCLTech; Poland; On-site; PLN 180,000 - 240,000; Full time

Benefits offered by this job

Life insurance

Private medical care

MultiSport Card

Glasses subsidy

Language courses subsidy

Holiday bonuses

Job summary

HCLTech is seeking a Security Operations Engineer to expand the ALaM program by onboarding new paramount applications into monitoring scope for SIEM use cases and DORA compliance by 2026. The role focuses on SIEM engineering, threat modelling, rule optimization, testing, and workshop facilitation.

You will work with SOC, engineering, and red teams to improve alert fidelity and ensure robust monitoring across critical applications, leveraging Azure/AWS, Windows/Linux, and SQL/Oracle environments.

Qualifications

• Hands-on experience with SIEM platforms, preferably Microsoft Sentinel.
• Proven ability in detection engineering, rule creation and rule testing.
• Ability to automate testing and validation with scripting (Python, PowerShell, Bash or similar).
• Strong communication in English (spoken and written); capable of leading workshops.

Responsibilities

• Detection Engineering: Build, optimize, and maintain SIEM detection rules (prefer Microsoft Sentinel).
• Testing & Automation: Test and verify use cases, automate testing workflows.
• Application Onboarding: Onboard key applications into monitoring scope.
• Requirements Gathering: Collaborate with application teams to define logging and detection needs.
• Workshop Facilitation: Lead workshops with application owners to align on security capabilities.
• Technical Documentation: Produce documentation for detection logic and verification results.
• Collaboration: Work with SOC, engineering, and red teams to improve alert fidelity.

Skills

SIEM Expertise

Detection Engineering

Scripting & Automation

English Communication

Cloud & Infra

Windows & Linux

SQL/Oracle Databases

Independent Worker

Workshop Facilitation

Job description

HCLTech is seeking a Security Operations Engineer to expand the ALaM program by onboarding new paramount applications into monitoring scope for SIEM use cases and DORA compliance by 2026. The role focuses on SIEM engineering, threat modelling, rule optimization, testing, and workshop facilitation.

You will work with SOC, engineering, and red teams to improve alert fidelity and ensure robust monitoring across critical applications, leveraging Azure/AWS, Windows/Linux, and SQL/Oracle environments.