Senior SIEM & Detection Engineer (Hybrid)

Corebridge Financial; Houston (TX); Hybrid; USD 168,000 - 195,000; Full time

Benefits offered by this job

Health insurance

401(k) with company match

Paid time off

Volunteer time off

Job summary

Corebridge Financial seeks a highly skilled Senior Cyber Security Engineer - SIEM and Automation to lead detection engineering, optimize logging, and integrate security tools. You will work with Security Operations, Threat Intelligence, and Engineering to deliver actionable SIEM insights and rapid incident detection across cloud, on‑prem, and hybrid environments.

The role focuses on developing high‑fidelity use cases, reducing false positives, and tuning alerts to balance detection fidelity with

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, or related field (or equivalent experience).
• 3–7+ years of experience in SIEM engineering, detection engineering, or security operations.
• Hands‑on experience with SIEM platforms (e.g., Splunk, Microsoft Sentinel, QRadar, Elastic).
• Strong understanding of log sources (Windows, Linux, cloud platforms, network devices).
• Experience with query languages (e.g., SPL, KQL, Lucene, SQL).
• Knowledge of MITRE ATT&CK framework and adversary tactics/techniques.
• Experience onboarding and parsing diverse data sources.

Responsibilities

• Design, develop, and maintain SIEM detection use cases aligned with MITRE ATT&CK and threat intelligence.
• Translate threat scenarios into actionable detection logic and correlation rules.
• Continuously improve detection coverage through gap analysis and adversary simulation insights.
• Define and implement logging requirements across cloud, endpoint, network, and application layers.
• Analyze log sources to ensure data quality, normalization, and completeness.
• Identify gaps in telemetry and recommend improvements to enhance visibility.
• Integrate new data sources into the SIEM (e.g., EDR, IAM, firewall, SaaS platforms).
• Work with engineering teams to onboard logs using APIs, agents, and log pipelines.
• Ensure proper parsing, enrichment, and normalization of ingested data.
• Reduce false positives through continuous alert tuning and threshold optimization.
• Implement risk-based alerting and prioritization strategies.
• Collaborate with SOC analysts to refine detection logic based on incident feedback.
• Maintain and optimize SIEM performance, scalability, and cost efficiency.
• Develop dashboards, reports, and visualizations for operational and leadership insights.
• Support automation and orchestration efforts with SOAR integrations where applicable.
• Partner with Threat Intelligence to operationalize indicators and emerging threats.
• Support incident response investigations with log analysis and detection enhancements.
• Stay current with evolving attack techniques and detection methodologies.

Skills

SIEM engineering

Detection engineering

Security operations

Splunk

Microsoft Sentinel

QRadar

Elastic

Windows logs

Linux logs

Cloud logs

SPL

KQL

Lucene

SQL

MITRE ATT&CK

Data onboarding

Education

Bachelor's degree in Cybersecurity/CS/related field

Tools

Splunk

Microsoft Sentinel

QRadar

Elastic

Job description

Corebridge Financial seeks a highly skilled Senior Cyber Security Engineer - SIEM and Automation to lead detection engineering, optimize logging, and integrate security tools. You will work with Security Operations, Threat Intelligence, and Engineering to deliver actionable SIEM insights and rapid incident detection across cloud, on‑prem, and hybrid environments.

The role focuses on developing high‑fidelity use cases, reducing false positives, and tuning alerts to balance detection fidelity with