Senior SIEM & SOAR Engineer — Onsite, Fort Mill

AccruePartners; Charlotte (NC); On-site; USD 110,000 - 140,000; Full time

Job summary

AccruePartners is seeking a senior cybersecurity professional to own and advance the organization’s SIEM and security operations environment. You will develop detection content, automate responses with SOAR, and serve as a senior escalation resource for complex incidents.

You will lead tuning across identity, endpoint, cloud and network telemetry, while mentoring Tier 1/2 analysts and coordinating with a 24/7 SOC team.

Qualifications

• 4+ years in cybersecurity with meaningful Security Operations or Incident Response exposure.
• 2+ years hands-on experience with an enterprise SIEM platform.
• Strong experience developing and tuning SIEM analytics rules, alerts, and detection content.
• Experience operating as a senior engineer, Tier 3 escalation resource, or advanced SOC analyst.
• Practical experience designing or maintaining SOAR playbooks.
• Strong understanding of incident response, investigations, evidence collection, and documentation.
• Automation scripting with PowerShell or Python.
• Experience integrating endpoint, identity, email, and network telemetry into a SIEM.
• Knowledge of MITRE ATT&CK framework and common threat techniques.
• Microsoft Sentinel exposure is valuable; familiarity with other security tools is beneficial.

Responsibilities

• Own the day-to-day management, health, tuning, and advancement of the organization's SIEM platform.
• Develop, tune, and maintain detection rules across identity, endpoint, cloud, network, and other telemetry.
• Serve as a senior escalation resource for complex or high-severity cybersecurity incidents.
• Conduct technical investigations, root-cause analysis, and forensic review as needed.
• Design and build SOAR playbooks that automate repetitive response activities.
• Develop automation workflows using PowerShell or Python.
• Evaluate and onboard new log sources, integrations, data connectors, and threat intelligence feeds.
• Partner with identity, endpoint, infrastructure, and network teams to maintain security visibility.
• Review alerts to improve detection quality and reduce false positives.

Skills

SIEM analytics

Incident response

SOAR playbooks

PowerShell/Python scripting

Threat detection

Mentorship

Education

Security certifications preferred

Tools

Microsoft Sentinel

SentinelOne

Proofpoint

Red Canary

Job description

AccruePartners is seeking a senior cybersecurity professional to own and advance the organization’s SIEM and security operations environment. You will develop detection content, automate responses with SOAR, and serve as a senior escalation resource for complex incidents.

You will lead tuning across identity, endpoint, cloud and network telemetry, while mentoring Tier 1/2 analysts and coordinating with a 24/7 SOC team.