SIEM & SOAR Engineer — Remote & Global Security Ops

EY; Warszawa; Hybrid; PLN 180,000 - 270,000; Full time

Benefits offered by this job

Flexible working

Hybrid/remote options

Professional development

EY Badges

Private healthcare

Job summary

EY Poland offers a role in Cybersecurity Engineering focused on designing and optimizing SIEM and SOAR platforms. You will lead deployments, onboard data sources, and develop detection content for complex, multinational projects across industries.

You will work with tools like CrowdStrike NG-SIEM, Splunk, XSOAR, Cribl, and NiFi, while collaborating with SOC teams and clients to mature security operations and automate responses.

Qualifications

• 4+ years of experience in Cybersecurity Engineering, Security Operations, Detection Engineering, or Security Consulting.
• Hands-on with at least one of CrowdStrike NG-SIEM, Splunk, XSOAR, Cribl, or Apache NiFi.
• Strong understanding of cybersecurity operations and threat detection principles.
• Experience with SIEM, SOAR, Data Ingestion, or SOC technologies.
• Knowledge of incident detection and response processes.
• Understanding of network security concepts and common attack techniques.
• Experience integrating security technologies and working with APIs.
• Knowledge of Windows, Linux, and cloud environments.
• Strong communication and stakeholder management skills.
• Very good command of English and Polish (B2/C1 level).

Responsibilities

• Design and implement enterprise SIEM architectures.
• Lead deployments of CrowdStrike NG-SIEM and Splunk solutions.
• Onboard security data sources into SIEM ecosystems using native ingestion methods as well as third-party solutions such as Cribl and Apache NiFi.
• Develop onboarding strategies and deployment roadmaps for enterprise environments.
• Create detection logic, correlation rules, dashboards, and automated queries.
• Design and implement automations within enterprise SOAR platforms.
• Lead deployments of XSOAR, CrowdStrike Fusion, and Splunk SOAR solutions.
• Integrate SIEM platforms and third-party security technologies into SOAR ecosystems.
• Fine-tune response workflows and collaborate with SOC teams.
• Support clients in improving SIEM and SOAR maturity and transforming their security operations capabilities.

Skills

Cybersecurity Engineering

Security Operations

Threat Detection

Incident Response

APIs

Tools

CrowdStrike NG-SIEM

Splunk

XSOAR

Cribl

Apache NiFi

Job description

EY Poland offers a role in Cybersecurity Engineering focused on designing and optimizing SIEM and SOAR platforms. You will lead deployments, onboard data sources, and develop detection content for complex, multinational projects across industries.

You will work with tools like CrowdStrike NG-SIEM, Splunk, XSOAR, Cribl, and NiFi, while collaborating with SOC teams and clients to mature security operations and automate responses.