Senior SIEM & SOAR Platform Engineer

Center for Internet Security, Inc.; United States; Remote; USD 129,000 - 225,000; Full time

Benefits offered by this job

Health insurance

401(k) with company match

Paid time off

Job summary

The Center for Internet Security (CIS) is seeking a Principal SIEM Engineer to own the SIEM and SOAR platform operations. You will build, tune, and run the SOC platform, manage end-to-end ingestion and case workflows, and serve as the primary escalation point for platform defects.

You’ll lead SOAR content and incident response, collaborating with SOC leadership and vendors. Ideal candidates have 7+ years in security monitoring, strong scripting (Python/SQL/RegEx), and experience with enterprise

Qualifications

• Bachelor’s degree in Information Technology, Cybersecurity, or a related field.
• 7+ years deploying, engineering, and operating enterprise security monitoring and logging platforms.
• 7+ years in security operations or security engineering in support of a SOC.
• 5+ years building SOAR automation in production environments.

Responsibilities

• Develop and maintain SOAR content, including case management configuration and playbooks.
• Configure and maintain the SIEM, including log source tagging and alert definitions.
• Build and tune detection content across sources monitored by CIS.
• Troubleshoot ingestion and case creation pipelines end-to-end; serve as tier 2 escalation.
• Participate in incident response and after-hours on-call rotation.

Skills

SIEM

SOAR

Python

SQL

RegEx

Incident response

Vendor management

Education

Bachelor’s degree in IT/Cybersecurity

Tools

SIEM platform

SOAR platform

Job description

The Center for Internet Security (CIS) is seeking a Principal SIEM Engineer to own the SIEM and SOAR platform operations. You will build, tune, and run the SOC platform, manage end-to-end ingestion and case workflows, and serve as the primary escalation point for platform defects.

You’ll lead SOAR content and incident response, collaborating with SOC leadership and vendors. Ideal candidates have 7+ years in security monitoring, strong scripting (Python/SQL/RegEx), and experience with enterprise