Senior SIEM Architect & Threat Detection Lead (Hybrid/Remote)

Ally Bank; New York (NY); Hybrid; USD 110,000 - 180,000; Full time

Benefits offered by this job

Time off & holidays

401K with match

Healthcare benefits

Job summary

Ally Financial is seeking a Principal Cyber Security Engineer to own end-to-end SIEM capability, from architecture to content engineering and automation. You will collaborate with SOC analysts, incident responders, threat hunters, and IT teams to ensure high-fidelity detections and compliant log management.

The role involves design of data ingestion pipelines, log onboard from diverse sources, and ongoing optimization for performance, availability, and cost.

Qualifications

• 5+ years in SIEM engineering or related security engineering roles.
• Bachelor’s degree in Computer Science, Information Security, or related field; or equivalent experience.
• Proven expertise with at least one enterprise SIEM platform end-to-end (e.g., Splunk).
• Strong proficiency in data parsing/normalization (regex, grok, KQL, SPL).
• Experience with security operations, incident response workflows, and threat detection frameworks.

Responsibilities

• Design and maintain the SIEM architecture including ingestion pipelines and retention strategies.
• Onboard logs from diverse sources (EDR, firewalls, cloud services, SaaS, containers).
• Implement data quality monitoring and SLA-driven dashboards for ingestion health and latency.
• Optimize SIEM performance, storage tiers, and cost control.
• Ensure RBAC, multitenancy, data governance, and disaster recovery plans.

Skills

SIEM engineering

Security engineering

Incident response

Threat detection

Cloud security

Scripting

Automation

Education

Bachelor's degree in Computer Science or Information Security

Tools

Splunk

Cribl

Microsoft Sentinel

QRadar

Elastic Security

Snowflake

Job description

Ally Financial is seeking a Principal Cyber Security Engineer to own end-to-end SIEM capability, from architecture to content engineering and automation. You will collaborate with SOC analysts, incident responders, threat hunters, and IT teams to ensure high-fidelity detections and compliant log management.

The role involves design of data ingestion pipelines, log onboard from diverse sources, and ongoing optimization for performance, availability, and cost.