Senior SIEM & SOAR Engineer — Remote

CIS; United States; Remote; USD 129,000 - 225,000; Full time

Job summary

CIS is seeking a Principal SIEM Engineer to lead the SIEM and SOAR Engineering team within the OIS department. The role is hands-on and focuses on SIEM configuration, SOAR playbooks, detection content, and end-to-end pipeline troubleshooting from collector to analyst case.

The position requires senior expertise in security monitoring, incident response, and vendor management, with a focus on delivering scalable MDR and SOC-as-a-Service onboarding for SLTT and other customers.

Qualifications

• Bachelor’s degree or equivalent in information technology, cybersecurity, or related field.

Responsibilities

• Develop and maintain SOAR content including case management configuration and playbooks.
• Configure and maintain SIEM including log source tagging, parsing, and alert definitions.
• Build and tune detection content across monitored sources (Suricata, CrowdStrike, Albert).
• Troubleshoot ingestion and case creation pipelines end-to-end and serve as tier-2 escalation for platform.
• Participate in incident response and after-hours on-call rotation.
• Engage with SIEM/SOAR vendor for escalations and assess vendor fixes for safety.
• Deliver MDR onboarding and SOC-as-a-service scoping, including use-case verification and health monitoring.
• Build integrations and dashboards across SIEM/SOAR data.
• Manage ingest volume within contractual limits.
• Maintain platform documentation and runbooks.
• Provide input to Product and leadership on platform capabilities and licensing.

Skills

RegEx

SQL

Python

SOAR automation

SIEM

Threat intel

Education

Bachelor’s degree in IT/Cybersecurity

Tools

CrowdStrike

Suricata

Albert

SIEM tooling

Job description

CIS is seeking a Principal SIEM Engineer to lead the SIEM and SOAR Engineering team within the OIS department. The role is hands-on and focuses on SIEM configuration, SOAR playbooks, detection content, and end-to-end pipeline troubleshooting from collector to analyst case.

The position requires senior expertise in security monitoring, incident response, and vendor management, with a focus on delivering scalable MDR and SOC-as-a-Service onboarding for SLTT and other customers.