SIEM Engineer

IDBNY; New York; Hybrid; USD 140,000 - 160,000; Full time

Job summary

IDB Bank is seeking a seasoned SIEM Engineer to design, implement, and optimize our SIEM across on-prem, cloud, and hybrid environments. You will work with SOC analysts, threat intel, and infra teams to strengthen cyber defense posture and incident response capabilities.

Responsibilities include developing detection use cases, integrating log sources, and building dashboards, alerting, and hunting queries. The role requires hands-on SIEM management, scripting, and strong knowledge of MITRE

Qualifications

• 5+ years of cybersecurity experience.
• 3+ years managing and engineering SIEM platforms.
• Experience supporting SOC operations and incident response.
• Experience in financial services or regulated industries preferred.

Responsibilities

• Manage and maintain enterprise SIEM platforms.
• Configure and optimize log ingestion, normalization, parsing, and retention.
• Integrate security data sources including:
• Firewalls
• IDS/IPS
• EDR/XDR
• Active Directory / Entra ID
• Network and endpoint security solutions
• Ensure availability, scalability, and performance of SIEM infrastructure.
• Detection Engineering & Use Case Development
• Develop and maintain correlation rules, analytics, and detection content.
• Create use cases aligned with MITRE ATT&CK techniques.
• Tune detection rules to reduce false positives and improve alert fidelity.
• Work with Purple Team, Red Team, and Threat Intelligence teams to improve detection coverage.
• Implement new monitoring capabilities for emerging threats.
• Security Monitoring & Incident Support
• Support SOC operations through advanced threat detection and alert analysis.
• Correlate events across multiple technologies to identify malicious activity.
• Perform root cause analysis and recommend containment improvements.
• Develop dashboards and reporting for operational visibility.
• Develop hunting queries to identify malicious behavior not detected by automated alerts.
• Integrate threat intelligence feeds into the SIEM platform.
• Create indicators of compromise (IOC) monitoring and enrichment processes.
• Identify suspicious trends and emerging attack patterns.
• Automation & Optimization
• Automate SIEM administration and monitoring tasks using scripting.
• Integrate SIEM with SOAR platforms and ticketing systems.
• Develop workflows for alert enrichment, escalation, and incident response.
• Improve operational efficiency through automation and orchestration.
• Governance, Compliance & Reporting
• Support regulatory and audit requirements.
• Maintain SIEM documentation, runbooks, and standards.
• Produce security metrics and executive reporting.
• Ensure log retention and monitoring practices meet compliance requirements.

Skills

KQL

PowerShell

Python

SQL

Threat hunting

MITRE ATT&CK

EDR/XDR concepts

Education

Microsoft SC-200

Splunk ES Admin

GCIH

GCIA

CISSP

Tools

Microsoft Sentinel

Splunk

QRadar

LogRhythm

Elastic Security

CrowdStrike NG-SIEM

Cribl

Job description

1114 Avenue of the Americas, NYC, NY, 10036

Role Overview

The SIEM Engineer is responsible for designing, implementing, maintaining, and optimizing the organization's Security Information and Event Management (SIEM) platform. This role supports Security Operations by developing detection use cases, integrating log sources, improving threat visibility, and enhancing incident response capabilities across on-premises, cloud, and hybrid environments. The SIEM Engineer works closely with SOC analysts, incident responders, threat intelligence teams, infrastructure teams, and security leadership to strengthen the organization's cyber defense posture.

Key Responsibilities

• Manage and maintain enterprise SIEM platforms.
• Configure and optimize log ingestion, normalization, parsing, and retention.
• Integrate security data sources including:
• Firewalls
• IDS/IPS
• EDR/XDR
• Active Directory / Entra ID
• Network and endpoint security solutions
• Ensure availability, scalability, and performance of SIEM infrastructure.
• Detection Engineering & Use Case Development
• Develop and maintain correlation rules, analytics, and detection content.
• Create use cases aligned with MITRE ATT&CK techniques.
• Tune detection rules to reduce false positives and improve alert fidelity.
• Work with Purple Team, Red Team, and Threat Intelligence teams to improve detection coverage.
• Implement new monitoring capabilities for emerging threats.
• Security Monitoring & Incident Support
• Support SOC operations through advanced threat detection and alert analysis.
• Correlate events across multiple technologies to identify malicious activity.
• Perform root cause analysis and recommend containment improvements.
• Develop dashboards and reporting for operational visibility.
• Develop hunting queries to identify malicious behavior not detected by automated alerts.
• Integrate threat intelligence feeds into the SIEM platform.
• Create indicators of compromise (IOC) monitoring and enrichment processes.
• Identify suspicious trends and emerging attack patterns.
• Automation & Optimization
• Automate SIEM administration and monitoring tasks using scripting.
• Integrate SIEM with SOAR platforms and ticketing systems.
• Develop workflows for alert enrichment, escalation, and incident response.
• Improve operational efficiency through automation and orchestration.
• Governance, Compliance & Reporting
• Support regulatory and audit requirements.
• Maintain SIEM documentation, runbooks, and standards.
• Produce security metrics and executive reporting.
• Ensure log retention and monitoring practices meet compliance requirements.

Required Qualifications

Experience

• 5+ years of cybersecurity experience.
• 3+ years managing and engineering SIEM platforms.
• Experience supporting SOC operations and incident response.
• Experience in financial services or regulated industries preferred.

Technical Skills

• Expertise in platforms such as:
• Microsoft Sentinel
• Splunk
• QRadar
• LogRhythm
• Elastic Security
• CrowdStrike NG-SIEM
• Cribl
• Strong knowledge of:
• Windows and Linux security logs
• Network security monitoring
• EDR/XDR technologies
• Threat hunting methodologies
• MITRE ATT&CK framework
• Scripting experience:
• KQL
• PowerShell
• Python
• SQL

Security Knowledge

• Log management and event correlation.
• Vulnerability management concepts.
• Zero Trust security principles.

Preferred Certifications

• Microsoft Certified: Security Operations Analyst (SC-200)
• Splunk Enterprise Security Certified Admin
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Intrusion Analyst (GCIA)
• CISSP

Compensation

The expected annual salary for this position is between $140,000 and $160,000 at the start of employment. A salary offer is determined on an individualized basis, taking into consideration factors such as an individual’s skills and experience. In addition to base salary, our total rewards package also includes eligibility for an annual bonus, medical, pharmacy, dental, and vision plans, life and disability insurance, employee wellness program, retirement and savings plans with employer contributions, generous holiday and paid time off schedules, parental leave, and tuition reimbursement.

Additional Information

The Bank Will Make Reasonable Accommodations To The Following Employees To Allow Them To Perform The Essential Functions Of Their Position, Except Where Doing So Would Result In Undue Hardship To The Bank

• Those with a known mental or physical disability.
• Pregnant individuals and/or individuals with pregnancy or childbirth-related medical conditions.
• Victims of domestic violence, sex offenses or stalking.
• Employees with religious observance and practice obligations.

Any employee who believes he or she needs an accommodation for any of the above reasons should contact their supervisor or a member of Human Resources to request such an accommodation. In each case, the Bank will engage in a good faith written or oral dialogue concerning the individual’s accommodation needs; potential accommodations that may address the individual’s accommodation needs, including alternatives to a requested accommodation; and the difficulties that such potential accommodations may pose for the employer.

The Bank retains the ultimate discretion to choose the appropriate reasonable accommodation. Upon reaching a final determination at the conclusion of the cooperative dialogue, the Bank will provide the requesting individual with a written final determination identifying any accommodation granted or denied. In addition, the Bank will maintain any information regarding the employee’s request and status in the strictest confidence, except as requested by the employee, as required on a need-to-know basis or as otherwise required by law.

Disclaimer

The above statements are intended to describe the general nature and level of work being performed by people assigned to this classification. They are not to be construed as an exhaustive list of all responsibilities, duties, and skills required of personnel so classified. All personnel may be required to perform duties outside of their normal responsibilities from time to time, as needed.

All your information will be kept confidential according to EEO guidelines.

We are operating on a Hybrid schedule.

IDB BANK, INCLUDING ITS SUBSIDIARIES AND DIVISIONS, PROVIDES EQUAL EMPLOYMENT OPPORTUNITIES TO ALL EMPLOYEES AND APPLICANTS FOR EMPLOYMENT WITHOUT REGARD TO RACE, COLOR, RELIGION, SEX, SEXUAL ORIENTATION, NATIONAL ORIGIN, AGE, DISABILITY, GENETIC STATUS, CITIZENSHIP STATUS, MARITAL STATUS, MILITARY OR VETERAN STATUS, CURRENT UNEMPLOYMENT OR ANY OTHER LEGALLY PROTECTED CATEGORY IN ACCORDANCE WITH APPLICABLE FEDERAL, STATE AND LOCAL LAW. NOTHING IN THIS SITE CONSTITUTES A PROMISE OR OFFER OF EMPLOYMENT.

Kindly review ourPrivacy Notice andGLBA Consumer Privacy Notice.