Senior SIEM Architect - Hybrid/Remote

Ally-Financial; Detroit (MI); Hybrid; USD 110,000 - 180,000; Full time

Benefits offered by this job

Time off and holidays

401K matching and financial wellness

Health insurance

Relocation assistance

Job summary

Ally Financial is seeking a Principal Cyber Security Engineer to lead end‑to‑end SIEM design, deployment, and optimization. You will own data onboarding, content engineering, automation, and continuous improvement across SIEM platforms, collaborating with SOC analysts, incident responders, threat hunters, IT operations, and application teams.

The role requires hands‑on expertise across SIEM ecosystems, data parsing, detection logic, and cloud logging.

Qualifications

• 5+ years of experience in SIEM engineering or related security engineering roles.
• Proven expertise with enterprise SIEM platforms end-to-end (Splunk preferred).
• Strong scripting and automation skills (Python, PowerShell).

Responsibilities

• Design and maintain SIEM architecture including data ingestion pipelines and retention strategies.
• Onboard logs from diverse sources (EDR, IAM, cloud, networks) and optimize data quality.
• Implement RBAC, multi-tenancy, and data governance in SIEM.
• Collaborate with SOC, IT, and cloud teams to ensure detections are high‑fidelity and compliant.

Skills

SIEM engineering

Regex/Grok/KQL

Python scripting

Cloud platforms (AWS/Azure)

Incident response understanding

Education

Bachelor's degree in Computer Science or related field

Tools

Splunk

Cribl

Microsoft Sentinel

QRadar

Elastic Security

Job description

Ally Financial is seeking a Principal Cyber Security Engineer to lead end‑to‑end SIEM design, deployment, and optimization. You will own data onboarding, content engineering, automation, and continuous improvement across SIEM platforms, collaborating with SOC analysts, incident responders, threat hunters, IT operations, and application teams.

The role requires hands‑on expertise across SIEM ecosystems, data parsing, detection logic, and cloud logging.