Principal SIEM Architect & Threat Detection Lead

Cybersecurity Jobs; Detroit (MI); On-site; USD 110,000 - 180,000; Full time

Benefits offered by this job

20 paid time off days

11 paid holidays

401(k) retirement plan

Tuition reimbursement

Employee stock purchase plan

Job summary

Ally Financial is seeking a Principal Cyber Security Engineer to lead the SIEM platform lifecycle from design through ongoing optimization. This on-site role in Detroit partners with SOC, incident response, threat hunting, IT operations, and application teams to deliver reliable log management and actionable detections.

You will own SIEM architecture, data ingestion, parsing, storage, retention, and performance tuning, while focusing on measurable detection outcomes using KPIs and KRIs.

Qualifications

• 5+ years in SIEM or security engineering roles.
• Bachelor's degree in Computer Science, Information Security, or related field or equivalent experience.
• Proven end-to-end experience with enterprise SIEM platforms (Splunk preferred).
• Strong proficiency in data parsing/normalization (regex, grok, KQL).

Responsibilities

• Design and maintain the SIEM architecture, including data ingestion, parsing, storage, and retention.
• Evaluate and implement SIEM features, and drive upgrades or migrations.
• Onboard logs from diverse sources (EDR, firewalls, IAM, cloud, containers, databases).
• Implement data quality monitoring and SLA-driven dashboards for ingestion health and latency.
• Optimize SIEM performance, storage tiers, and cost control.
• Define RBAC and multitenancy, ensure high availability and DR.
• Define KPIs/KRIs (MTTD, alert quality, data freshness).
• Run purple-team exercises and drive remediation work.
• Provide runbooks, knowledge base articles, and SOC/IT training.
• Align SIEM data handling with SOC 2, ISO 27001, PCI-DSS, HIPAA, GDPR.

Skills

SIEM engineering

Log management

KPI/KRI metrics

Automation scripting

Cloud platforms AWS Azure

Education

Bachelor's degree in CS/Info Security

Tools

Splunk

Cribl

Microsoft Sentinel

QRadar

Elastic Security

Job description

Ally Financial is seeking a Principal Cyber Security Engineer to lead the SIEM platform lifecycle from design through ongoing optimization. This on-site role in Detroit partners with SOC, incident response, threat hunting, IT operations, and application teams to deliver reliable log management and actionable detections.

You will own SIEM architecture, data ingestion, parsing, storage, retention, and performance tuning, while focusing on measurable detection outcomes using KPIs and KRIs.