Forward-Deployed Data Engineer — SIEM & SOAR

Tenex; Sarasota, Scottsdale, Kansas City (FL, AZ, MO); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Competitive salary

Career growth

Job summary

Tenex is seeking a Forward Deployed Data Engineer — SIEM/SOAR to design and implement detection content, parsers, and SOAR playbooks for MSSP-grade defenses. You will craft dashboards and integrations, and serve as a technical trainer for customers.

You’ll work with Google SecOps and Microsoft Sentinel, apply MITRE ATT&CK, and help customers understand content and platform capabilities at a deep technical level.

Qualifications

• 3+ years in detection engineering, content engineering, or security operations.
• Proficient in SIEM detection rule development (YARA-L, KQL).
• Experience building SOAR playbooks and automation workflows.
• Experience with log parsers for diverse data sources.
• Knowledge of MITRE ATT&CK and its application to detection content.
• Proficient in Python, cloud run functions, and REST API integrations.
• Experience building security dashboards for operations.
• Understanding of threat intelligence and how TTPs translate into detection content.

Responsibilities

• Author, tune, and maintain detection rules, correlation logic, and threat content for SIEM (Google SecOps, Sentinel).
• Build and validate log parsers for new data sources in customer environments.
• Develop and maintain SOAR playbooks, automation workflows, and dashboards for common alert types.
• Build cloud run functions, scripts, and API integrations where connectors are missing.
• Collaborate with Deployment Engineers to ensure content is ready for new go-lives.
• Monitor detection coverage gaps and address them with content improvements.
• Incorporate threat intelligence and MITRE ATT&CK into detection logic.
• Serve as a technical trainer for customers on content, dashboards, and platform capabilities.
• Document all content with metadata, use cases, and tuning notes.
• Support AI-assisted content generation workflows with human review as the gate.

Skills

Detection rule development

SOAR playbooks

Log parser development

Python

REST API integrations

MITRE ATT&CK knowledge

Cloud run functions

Education

Bachelor's degree in CS/Cybersecurity/Engineering

CISSP/CISM/GIAC/Cloud certs

Tools

Google SecOps

Microsoft Sentinel

Job description

Tenex is seeking a Forward Deployed Data Engineer — SIEM/SOAR to design and implement detection content, parsers, and SOAR playbooks for MSSP-grade defenses. You will craft dashboards and integrations, and serve as a technical trainer for customers.

You’ll work with Google SecOps and Microsoft Sentinel, apply MITRE ATT&CK, and help customers understand content and platform capabilities at a deep technical level.