Senior SIEM & SOAR Engineer Platform Owner

CIS; United States; Remote; USD 129,000 - 225,000; Full time

Benefits offered by this job

Health Insurance

401(k) with 4% match

Paid Time Off

Job summary

The Principal SIEM Engineer at CIS leads the SIEM/SOAR engineering efforts for CIS’s SOC, owning end-to-end log ingestion, detection content, and playbook automation. You will act as the terminal escalation point, ensure platform reliability, and drive incident response and vendor coordination.

You will build detection content, maintain SOAR templates, and collaborate with SOC leadership to implement escalations and automation, across Windows, Unix, network devices, and cloud sources.

Qualifications

• Bachelor’s degree in Information Technology, Cybersecurity, or a related field
• 7+ years deploying, engineering, and operating enterprise security monitoring and logging platforms
• 7+ years in security operations or security engineering supporting a SOC
• 5+ years building SOAR automation in production
• Experience troubleshooting end-to-end log pipelines and vendor escalations
• Strong scripting experience (Python, PowerShell) and RegEx proficiency
• Authorized to work in the United States

Responsibilities

• Develop and maintain SOAR content including case management and playbooks
• Configure SIEM and log source onboarding, parsing, and alerting
• Build and tune detection content across multiple sources
• Troubleshoot ingestion and case creation end-to-end; tier 2 escalation
• Participate in incident response and after-hours on-call rotation
• Vendor escalation management and defect evaluation with SIEM/SOAR providers
• Onboard MDR and SOCaaS offerings including testing and health monitoring
• Build connectors and log source integrations; manage log volumes and dashboards

Skills

SIEM

SOAR

Python

RegEx

Incident response

Education

Bachelor’s degree in Information Technology or Cybersecurity

Tools

CrowdStrike

Albert

Suricata

Job description

The Principal SIEM Engineer at CIS leads the SIEM/SOAR engineering efforts for CIS’s SOC, owning end-to-end log ingestion, detection content, and playbook automation. You will act as the terminal escalation point, ensure platform reliability, and drive incident response and vendor coordination.

You will build detection content, maintain SOAR templates, and collaborate with SOC leadership to implement escalations and automation, across Windows, Unix, network devices, and cloud sources.