Senior SIEM Engineer - Detection & Analytics

Claranet limited; Lisboa; On-site; EUR 55,000 - 75,000; Full time

Job summary

Claranet Limited in Lisbon/Porto is seeking a seasoned SIEM Engineer to join our security team. You will design, implement and maintain security monitoring across enterprise environments, focusing on Microsoft Sentinel and Graylog.

You will develop detection use cases, onboard log sources, automate operations with PowerShell, Bash, Python and Ansible, and collaborate with IT teams to strengthen monitoring and threat detection.

Qualifications

• 5+ years in cybersecurity operations with a focus on incident response, SIEM management and cybersecurity technical consultancy.
• Proven experience administering and engineering Microsoft Sentinel environments.
• Strong experience writing and optimizing KQL queries for detection engineering.
• Solid experience with SIEM technologies such as Microsoft Sentinel and Graylog.
• Hands-on knowledge of log collection technologies including Syslog-ng, Logstash, NXLog, Windows Event Forwarding (WEF), and Syslog.
• Experience deploying and maintaining Linux-based security infrastructure.
• Strong scripting and automation skills using PowerShell, Bash, Python, or Ansible.
• Familiarity with Docker, Podman, and containerized deployments.
• Proficiency in English to communicate effectively with technical and executive stakeholders.

Responsibilities

• Design, implement, and maintain security monitoring solutions across enterprise environments.
• Develop, tune, and optimize detection use cases within Microsoft Sentinel and other SIEM platforms.
• Engineer and onboard log sources, ensuring data quality, normalization, and operational reliability.
• Create, maintain, and improve KQL detection rules, analytics, watchlists, and threat hunting queries.
• Automate security operations using PowerShell, Bash, Python, Ansible, and other scripting technologies.
• Deploy and manage SIEM infrastructure components, including Graylog, Logstash, Syslog-ng, Docker/Podman, and related services.
• Perform security engineering activities to enhance monitoring coverage and detection capabilities.
• Investigate and improve security telemetry, reducing false positives while increasing detection accuracy.
• Collaborate with infrastructure, networking, and security teams to integrate new technologies into the monitoring ecosystem.
• Develop technical documentation, implementation guides, and operational procedures.
• Support vulnerability management initiatives by improving visibility and security monitoring.
• Ensure security monitoring solutions follow industry best practices and operational standards.

Skills

SIEM engineering

Incident response

Microsoft Sentinel

KQL

Log collection

Automation scripting

Docker/Podman

Linux security

English communication

Threat hunting

Tools

Microsoft Sentinel

Graylog

Syslog-ng

Logstash

NXLog

WEF

Docker/Podman

Job description

Claranet Limited in Lisbon/Porto is seeking a seasoned SIEM Engineer to join our security team. You will design, implement and maintain security monitoring across enterprise environments, focusing on Microsoft Sentinel and Graylog.

You will develop detection use cases, onboard log sources, automate operations with PowerShell, Bash, Python and Ansible, and collaborate with IT teams to strengthen monitoring and threat detection.