Principal SIEM Engineer - Vice President

Morgan-Stanley; Baltimore (MD); On-site; USD 140,000 - 195,000; Full time

Benefits offered by this job

Medical

Prescription Drug

Dental

Vision

HSA

Paid Time Off

Sick Leave

Parental Leave

Vacation Days

401(k)

Job summary

Morgan Stanley's Cyber Response Platforms seeks an experienced SIEM Engineer to develop analytics, fine-tune detection rules, and support SOC infrastructure. You will monitor SIEM platforms, create detailed security metrics, and collaborate across teams to integrate SIEM capabilities into incident response workflows.

The role emphasizes hands-on rule tuning, alert deduplication, and exposure to MITRE ATT&CK techniques, with opportunities to work on scalable detection solutions in a global

Qualifications

• Experience in the creation and management of detection logic in SIEMs such as Elasticsearch, Splunk, ArcSight or Microsoft Sentinel.
• Experience developing automations in SOAR platforms (e.g., Palo Alto XSOAR, SumoLogic, Swimlane).
• Knowledge of MITRE ATT&CK, indicators of compromise (YARA, STIX/TAXII) and data normalization.
• Familiar with CI/CD tooling and scripting (Python preferred).

Responsibilities

• Development of analytics in Elastic Search to detect actionable security alerts.
• Monitor and support SIEM platforms to ensure SOC infrastructure security and stability.
• Create security metrics, reports, and dashboards showing the organization’s security posture.
• Collaborate with cross-functional teams to integrate SIEM capabilities into cyber response workflows.

Skills

SIEM rule tuning

MITRE ATT&CK

Python scripting

SOAR automation

Tools

Elasticsearch

Splunk

ArcSight

Microsoft Sentinel

Palo Alto XSOAR

SumoLogic

Swimlane

Jenkins

GitLab CI

GitHub Actions

Kafka

NiFi

Spark

Job description

Technology works as a strategic partner with Morgan Stanley business units and the world's leading technology companies to redefine how we do business in ever more global, complex, and dynamic financial markets. Morgan Stanley's sizeable investment in technology results in quantitative trading systems, cutting-edge modelling and simulation software, comprehensive risk and security systems, and robust client-relationship capabilities, plus the worldwide infrastructure that forms the backbone of these systems and tools. Our insights, our applications and infrastructure give a competitive edge to clients' businesses and to our own.Position OverviewCyber Response Platforms is looking for an experienced (10+ years) cyber-security professional to join their team as a SIEM Engineer. Our ideal candidate has hands-on experience in computer network defense working either in a Security Operations Center or Cyber Incident Response Team.What you'll do in the role:Development of analytics in Elastic Search to detect actionable security alerts. Develop and fine-tune advanced detection rules, alerting mechanisms, and use cases to identify and respond to sophisticated security threatsMonitor and support SIEM platforms to ensure security and stability of SOC infrastructureCreate comprehensive security metrics, reports, dashboards, providing detailed insights into the organization's security postureCollaborate with cross-functional teams to ensure seamless integration of SIEM capabilities into broader cyber response workflows Skills required (essential)Champion a collaborative and inclusive team culture that encourages innovation, ownership, and continuous improvementWhat you'll bring to the role:Experience in the creation and management of detection logic in SIEMs (e.g Elastic Search, Splunk, ArcSight, Microsoft Sentinel)Experience developing automations in SOAR (e.g. Palo Alto XSOAR, SumoLogic, Swimlane)Experience with SIEM rule tuning, correlation logic, alert de-duplication and false-positive reduction techniquesStrong knowledge of exploitation techniques (e.g. MITRE ATT&CK) and use-case developmentExperience within the application of Indicators of Compromise (e.g. YARA rules, STIX and TAXII)Experience with data normalization (e.g. Kafka, NiFi, Spark)Experience with CI/CD technology (e.g Jenkins, GitLab CI, GitHub Actions)Intermediate experience developing scripts in PythonStrong communication, task management and organizational skillsWHAT YOU CAN EXPECT FROM MORGAN STANLEY:At Morgan Stanley, we raise, manage and allocate capital for our clients – helping them reach their goals. We do it in a way that’s differentiated – and we’ve done that for 90 years. Our values - putting clients first, doing the right thing, leading with exceptional ideas, committing to diversity and inclusion, and giving back - aren’t just beliefs, they guide the decisions we make every day to do what's best for our clients, communities and more than 80,000 employees in 1,200 offices across 42 countries. At Morgan Stanley, you’ll find an opportunity to work alongside the best and the brightest, in an environment where you are supported and empowered. Our teams are relentless collaborators and creative thinkers, fueled by their diverse backgrounds and experiences. We are proud to support our employees and their families at every point along their work-life journey, offering some of the most attractive and comprehensive employee benefits and perks in the industry. There’s also ample opportunity to move about the business for those who show passion and grit in their work.To learn more about our offices across the globe, please copy and paste https://www.morganstanley.com/about-us/global-offices into your browser.Salary range for the position: $140,000 - $195,000/Yr. The successful candidate may be eligible for an annual discretionary incentive compensation award. The successful candidate may be eligible to participate in the relevant business unit’s incentive compensation plan, which also may include a discretionary bonus component. Morgan Stanley offers a full spectrum of benefits, including Medical, Prescription Drug, Dental, Vision, Health Savings Account, Dependent Day Care Savings Account, Life Insurance, Disability and Other Insurance Plans, Paid Time Off (including Sick Leave consistent with state and local law, Parental Leave and 20 Vacation Days annually), 10 Paid Holidays, 401(k), and Short/Long Term Disability, in addition to other special perks reserved for our employees. Please visit mybenefits.morganstanley.com to learn more about our benefit offerings.Morgan Stanley is an equal opportunity employer committed to building and maintaining a workforce that is diverse in experience and background. Our recruiting efforts reflect our strong commitment to a culture of inclusion, where individuals are hired, developed, and advanced based on their skills and talents.Our workforce reflects a broad cross-section of the global communities in which we operate, bringing a variety of backgrounds, talents, perspectives, and experiences.For more information, please visit : https://www.morganstanley.com/people-opportunities/eeo .