Senior SIEM Platform Engineer - Remote, Cloud Automation

Coalfire; Northern (KY); Hybrid; USD 85,000 - 141,000; Full time

Benefits offered by this job

Flexible work model

Parental leave

Certification reimbursement

Digital mental health and wellbeing

Job summary

Coalfire is seeking a SIEM Platform Engineer to design, operate, and continually improve SIEM capabilities across cloud and on-prem environments. You will own data ingestion, parsing, retention, and governance while supporting FedRAMP and other regulatory requirements.

Collaboration with detection engineering, security operations, and cloud teams is essential. The role emphasizes automation, IaC, and scalable architectures using Terraform, Ansible, GitLab/GitHub, and Python.

Qualifications

• Experience designing, implementing, or operating SIEM in enterprise or cloud environments.
• Experience delivering platform capabilities from requirements through handoff and documentation.
• Ability to integrate multiple security, cloud, endpoint, identity, network, and operational tools.

Responsibilities

• Design, implement, and maintain SIEM platform architectures across AWS, Azure, and GCP.
• Build and operate log collection and ingestion pipelines with various collectors and APIs.
• Onboard, normalize, validate, and troubleshoot data sources from cloud platforms and on-prem systems.
• Establish and maintain platform standards for parsing, data models, and retention.
• Perform SIEM admin tasks including upgrades, tuning, capacity planning, and monitoring.

Skills

SIEM design

Cloud security

Security operations

Incident response

Communication

Agile

Education

Bachelor's degree in IT / CS / cybersecurity

Tools

Terraform

Ansible

GitLab

GitHub

Python

Splunk

Microsoft Sentinel

Elastic

Sumo Logic

Job description

Coalfire is seeking a SIEM Platform Engineer to design, operate, and continually improve SIEM capabilities across cloud and on-prem environments. You will own data ingestion, parsing, retention, and governance while supporting FedRAMP and other regulatory requirements.

Collaboration with detection engineering, security operations, and cloud teams is essential. The role emphasizes automation, IaC, and scalable architectures using Terraform, Ansible, GitLab/GitHub, and Python.