Siem Engineer

Claranet; Lisboa; Hybrid; EUR 65,000 - 90,000; Full time

Benefits offered by this job

Desenvolvimento profissional regular

Recursos para certificações

Programas de team building

Ambiente de trabalho amigável

Job summary

A Claranet está à procura de um(a) SIEM Engineer para integrar a equipa interna, baseada em Lisboa/Porto, com atuação híbrida. Oекоменду-se experiência em monitorização de segurança, gestão de SIEM e automação de operações de Cybersecurity.

Procuramos profissionais com 5+ anos em operações de cibersegurança, proficiência em Microsoft Sentinel e competências em scripting (PowerShell, Python) para otimizar deteção, reduzir falsos positivos e colaborar com equipas de infraestruturas, rede e

Qualifications

• Experiência comprovada em operações de cibersegurança e resposta a incidentes.
• Gestão e engenharia de ambientes Microsoft Sentinel.
• Criação e otimização de consultas KQL para detecção.
• Experiência prática com SIEM (Microsoft Sentinel e Graylog).
• Conhecimento de logs: Syslog-ng, Logstash, NXLog, WEF e Syslog.

Responsibilities

• Desenhar, implementar e manter soluções de monitorização de segurança em ambientes empresariais.
• Desenvolver, afinar e otimizar casos de deteção no Microsoft Sentinel e outras plataformas SIEM.
• Engenheirar e on-board de fontes de logs, assegurando qualidade e normalização de dados.
• Criar, manter e melhorar regras KQL, analíticas, watchlists e queries de threat hunting.
• Automatizar operações de segurança usando PowerShell, Bash, Python, Ansible e outras tecnologias de scripting.
• Desplegar e gerir componentes de infraestrutura SIEM, incluindo Graylog, Logstash, Syslog-ng, Docker/Podman e serviços relacionados.
• Conduzir atividades de engenharia de segurança para ampliar a cobertura de monitorização e deteção.
• Investigar e melhorar telemetria de segurança, reduzindo falsos positivos e aumentando a deteção.

Skills

Incident response

Cybersecurity operations

Monitoring design

Stakeholder communication

Cloud security concepts

Inglês técnico

Tools

Microsoft Sentinel

Graylog

Logstash

Docker/Podman

Syslog-ng

NXLog

Windows Event Forwarding (WEF)

Python

PowerShell

Ansible

Job description

SIEM Engineer

Empresa : Claranet
Tipo de Emprego : Periodo Integral
Lisbon, Portugal

Descrição do Emprego - SIEM Engineer

We're fast learners, hard workers, natural collaborators... and we Make Modern Happen!

Our ambition is to unlock the potential of our digital world so that organisations everywhere can innovate and thrive securely.

We aim to achieve this goal by bringing together the world's most talented people and the most powerful technologies, combining them to address our customers' challenges and to build something stronger together.

If you share our vision, join us!

Right now, we are looking for a SIEM Engineer to integrate our internal team, based in Lisbon/ Porto.

Your responsibilities include:

• Design, implement, and maintain security monitoring solutions across enterprise environments.
• Develop, tune, and optimize detection use cases within Microsoft Sentinel and other SIEM platforms.
• Engineer and onboard log sources, ensuring data quality, normalization, and operational reliability.
• Create, maintain, and improve KQL detection rules, analytics, watchlists, and threat hunting queries.
• Automate security operations using PowerShell, Bash, Python, Ansible, and other scripting technologies.
• Deploy and manage SIEM infrastructure components, including Graylog, Logstash, Syslog-ng, Docker/Podman, and related services.
• Perform security engineering activities to enhance monitoring coverage and detection capabilities.
• Investigate and improve security telemetry, reducing false positives while increasing detection accuracy.
• Collaborate with infrastructure, networking, and security teams to integrate new technologies into the monitoring ecosystem.
• Develop technical documentation, implementation guides, and operational procedures.
• Support vulnerability management initiatives by improving visibility and security monitoring.
• Ensure security monitoring solutions follow industry best practices and operational standards.

You must have:

• 5+ years of experience in cybersecurity operations, with a focus on incident response, SIEM management and cybersecurity technical consultancy.
• Proven experience administering and engineering Microsoft Sentinel environments.
• Strong experience writing and optimizing KQL queries for detection engineering.
• Solid experience with SIEM technologies such as Microsoft Sentinel and Graylog.
• Hands-on knowledge of log collection technologies including Syslog-ng, Logstash, NXLog, Windows Event Forwarding (WEF), and Syslog.
• Experience deploying and maintaining Linux-based security infrastructure.
• Strong scripting and automation skills using PowerShell, Bash, Python, or Ansible.
• Familiarity with Docker, Podman, and containerized deployments.
• Proficiency in English to communicate effectively with technical and executive stakeholders.

We value:

• Microsoft certifications such as SC-200 (Microsoft Security Operations Analyst) or AZ-500 (Azure Security Engineer).
• Knowledge of threat modeling frameworks and detection methodologies like MITRE ATT&CK.
• Strong analytical thinking for telemetry optimization and noise reduction.
• Excellent communication skills to convey complex technical concepts to multi-disciplinary teams.
• A proactive approach to continuous learning and adapting to cloud security tools.

We offer:

• Regular professional development;
• Certification paths resources;
• Regular teambuilding programs;
• Friendly workplace.

Workplace: Lisbon/Porto - Hybrid

Claranet: Make Modern Happen!