Senior SOC Tools Engineer (Elastic SIEM & Automation)

Closer Consulting; Lisboa; Híbrido; EUR 70 000 - 95 000; Tempo integral

Resumo da oferta

Closer Consulting is seeking a Senior SOC Tools Engineer to own the Elastic SIEM and automation across our SOC ecosystem. You will bridge Security Operations, System Architecture, and DevOps, delivering highly automated, container-based tooling and scalable SIEM architecture.

You will enable SOC analysts through automation (SOAR) and CI/CD pipelines, while supporting cross-functional teams in a hybrid Lisbon-based environment.

Qualificações

• Elastic Stack expertise in design and deployment.
• Experience with GitLab CI/CD, Ansible, Linux, and containers.
• Strong scripting in Python or Bash.
• Deep Linux OS and virtualization/networking knowledge.
• Understanding of SOAR, EDR, IAM concepts.

Responsabilidades

• SIEM engineering & architecture for Elastic Stack.
• Automation & CI/CD using GitOps, pipelines, Ansible and containers.
• Integration of SIEM/SOAR/EDR with devices and PKI networks.
• Build and run operations including capacity management and incident resolution.
• SOC enablement and knowledge transfer to analysts.

Conhecimentos

Elastic Stack

DevOps pipelines

Python scripting

Linux & Networking

SOAR / IAM

English communication

Cross-cultural teamwork

Ferramentas

GitLab CI/CD

Ansible

Kubernetes

Docker

Linux

VMware/KVM

Descrição da oferta de emprego

Mutual Respect, Empathy, Innovation, and Professional Pride. Do you see yourself within these values?

Founded in 2006 with the mission "To Challenge Complexity", Closer Consulting is a Data Science company specializing in Business Intelligence, Advanced Analytics, and Artificial Intelligence.

Developing projects in the most diverse industries – Banking, Telecommunications, Healthcare, Retail, Energy, Insurance, and Aviation, among others –, we have created an environment where the brightest enquiring minds feel at home, providing our people with the means, opportunities and support they need to thrive and innovate.

We are seeking a skilled Senior SOC Tools Engineer (Elastic SIEM & Automation) to take on new challenges in a hybrid work model in Lisbon.

About the Role

We are looking for a Senior SOC Tools Engineer to take ownership of the engineering, qualification, and automation of our Elastic SIEM platform and SOC ecosystem.

In this role, you will bridge the gap between Security Operations, System Architecture, and DevOps. You will be responsible for building highly automated, container-based security tooling, scaling our SIEM architecture, and enabling SOC analysts through automation (SOAR) and continuous integration (GitLab CI/CD, Ansible).

Key Responsibilities

• SIEM Engineering & Architecture: Lead the design, capacity planning, continuous integration, and evolution of our Elastic Stack (ELK) SIEM within the enterprise/OINIS ecosystem.
• Automation & CI/CD: Industrialize SOC tools using GitOps, GitLab CI/CD pipelines, Ansible playbooks, and containerized environments (Kubernetes/Docker).
• Integration & Ingestion: Connect and interface SIEM/SOAR/EDR tools with network devices, firewalls, IPS, and identity platforms (PKI, 2FA, Tacacs).
• Build & Run Operations: Handle high-level platform maintenance, capacity management, and complex incident resolution for SOC services.
• SOC Enablement: Support SOC analysts, optimize detection mechanisms, and drive knowledge-transfer sessions.

What We Are Looking For

• Elastic Stack Expertise: Solid experience designing, deploying, and optimizing ELK / Elastic SIEM.
• DevOps & Infrastructure Skills: Hands-on experience with GitLab CI/CD, Ansible, Linux environments, and containerization (Kubernetes / Docker).
• Strong Scripting: Proficiency in Python, Bash, or similar languages to automate SOC workflows.
• Systems & Networking Knowledge: Deep understanding of Linux OS, virtualized infrastructure (VMware/KVM), network concepts (IPv4/IPv6, routing), and security architecture (Firewalls, IPS).
• Security & Auth Protocols: Functional awareness of SOAR, EDR, and IAM concepts (PKI, OTP, Identity Providers, TACACS+).
• Communication: Fluency in English (essential for collaborating with global operational teams).
• Self-motivated, autonomous, and comfortable working in remote or hybrid multi-cultural teams.

Nice to Have

• Background or experience in the Telecommunications (Telco) industry.
• Familiarity with open-source security ecosystems and detection engineering frameworks (MITRE ATT&CK).

Closer is a company that values diversity and inclusion. We are committed to fostering an environment where everyone is treated with dignity and respect, regardless of race, gender, beliefs, sexual orientation, physical or mental disability, or other personal characteristics.

At Closer, we embrace the unique perspectives and experiences that everyone brings, and we believe that it is a fundamental driver for the success we've achieved.