Senior SIEM & Threat Detection Architect

Morgan-Stanley; Baltimore (MD); On-site; USD 140,000 - 195,000; Full time

Benefits offered by this job

Medical

Prescription Drug

Dental

Vision

HSA

Paid Time Off

Sick Leave

Parental Leave

Vacation Days

401(k)

Job summary

Morgan Stanley's Cyber Response Platforms seeks an experienced SIEM Engineer to develop analytics, fine-tune detection rules, and support SOC infrastructure. You will monitor SIEM platforms, create detailed security metrics, and collaborate across teams to integrate SIEM capabilities into incident response workflows.

The role emphasizes hands-on rule tuning, alert deduplication, and exposure to MITRE ATT&CK techniques, with opportunities to work on scalable detection solutions in a global

Qualifications

• Experience in the creation and management of detection logic in SIEMs such as Elasticsearch, Splunk, ArcSight or Microsoft Sentinel.
• Experience developing automations in SOAR platforms (e.g., Palo Alto XSOAR, SumoLogic, Swimlane).
• Knowledge of MITRE ATT&CK, indicators of compromise (YARA, STIX/TAXII) and data normalization.
• Familiar with CI/CD tooling and scripting (Python preferred).

Responsibilities

• Development of analytics in Elastic Search to detect actionable security alerts.
• Monitor and support SIEM platforms to ensure SOC infrastructure security and stability.
• Create security metrics, reports, and dashboards showing the organization’s security posture.
• Collaborate with cross-functional teams to integrate SIEM capabilities into cyber response workflows.

Skills

SIEM rule tuning

MITRE ATT&CK

Python scripting

SOAR automation

Tools

Elasticsearch

Splunk

ArcSight

Microsoft Sentinel

Palo Alto XSOAR

SumoLogic

Swimlane

Jenkins

GitLab CI

GitHub Actions

Kafka

NiFi

Spark

Job description

Morgan Stanley's Cyber Response Platforms seeks an experienced SIEM Engineer to develop analytics, fine-tune detection rules, and support SOC infrastructure. You will monitor SIEM platforms, create detailed security metrics, and collaborate across teams to integrate SIEM capabilities into incident response workflows.

The role emphasizes hands-on rule tuning, alert deduplication, and exposure to MITRE ATT&CK techniques, with opportunities to work on scalable detection solutions in a global