SIEM Engineer II

SCIGON; Austin (TX); On-site; USD 149,000 - 166,000; Full time

Job summary

SCIGON is seeking a hands-on SIEM Engineer II to deepen expertise in SIEM platforms, contribute to data-driven detection capabilities, and manage day-to-day SIEM operations. You will collaborate with Cybersecurity Operations, IT, Infrastructure, Cloud, and Applications teams to onboard log sources, develop detections, and create dashboards that enhance visibility and response.

This role offers growth in security analytics and observability.

Qualifications

• Experience with SIEM platforms such as Google SecOps, Splunk, Exabeam, or Microsoft Sentinel.
• Hands-on experience with Cribl pipelines and log routing, enrichment, and performance optimization.
• Ability to onboard log sources via APIs, agents, syslog, and cloud-native logging services.
• Experience building dashboards, searches, and reports for SOC and threat hunting.
• Strong collaboration with IT, Cloud, and Application teams to ensure logging coverage.

Responsibilities

• Assist in the implementation, administration, and ongoing optimization of the SIEM platform.
• Develop and refine SIEM use cases, correlation rules, and alerting logic.
• Create and enhance dashboards, searches, and reports to support SOC activities.
• Contribute to SIEM architecture, data flows, onboarding processes, and procedures.
• Help establish and monitor data quality standards for telemetry.

Skills

SIEM platforms

Security analytics

Scripting/queries (SPL, KQL, Python)

Detection engineering

Incident response

Dashboards & reporting

Cross-team collaboration

Education

Bachelor’s degree or equivalent

Tools

Cribl

Job description

What You’ll Do

Are you a hands-on security engineer ready to deepen your expertise in SIEM platforms and help build scalable, data-driven detection capabilities? As aSIEM Engineer II, you will play a key role in the implementation, optimization, and day-to-day management of the organization's Security Information and Event Management (SIEM) platform. You’ll contribute to the ingestion, normalization, and enrichment of security telemetry while supporting detection engineering, incident response, and security analytics. Working within the Cybersecurity function, you’ll collaborate with Cybersecurity Operations, IT, Infrastructure, Cloud, and Application teams to onboard log sources, develop detections, and create dashboards that drive visibility and response. This is an opportunity to grow your technical depth while making a measurable impact on the organization’s security posture.

• SIEM Platform Support- Assist in the implementation, administration, and ongoing optimization of the organization\'s SIEM platform (e.g., Google Security Operations (SecOps), Splunk, Exabeam, Microsoft Sentinel).


• Cribl Development- Support the design and maintenance of Cribl pipelines, including data routing, filtering, enrichment, and performance optimization.


• Log Integration- Build and maintain integrations for standard and custom log sources using APIs, agents, syslog, and cloud-native logging services.


• Detection Enablement- Partner with Cybersecurity Operations to develop and refine SIEM use cases, correlation rules, and alerting logic.


• Dashboards & Reporting- Create and enhance dashboards, searches, and reports to support Security Operations Center (SOC) activities and threat hunting.


• Documentation- Contribute to documentation of SIEM architecture, data flows, onboarding processes, and operational procedures.


• Data Quality Assurance- Help establish and monitor data quality standards to ensure reliable and accurate telemetry.


• Cross-Team Collaboration- Work with IT, Cloud, and Application teams to onboard new systems and ensure proper logging coverage.


• Incident Support- Provide support during security incidents, assisting with investigation and analysis efforts.


• Continuous Learning- Stay current on SIEM technologies, security analytics, and observability trends to enhance capabilities.

SIEM Engineer II

Salary:$149,000-$166,000

What You’ll DoAre you a hands-on security engineer ready to deepen your expertise in SIEM platforms and help build scalable, data-driven detection capabilities? As aSIEM Engineer II, you will play a key role in the implementation, optimization, and day-to-day management of the organization\'s Security Information and Event Management (SIEM) platform. You’ll contribute to the ingestion, normalization, and enrichment of security telemetry while supporting detection engineering, incident response, and security analytics. Working within the Cybersecurity function, you’ll collaborate with Cybersecurity Operations, IT, Infrastructure, Cloud, and Application teams to onboard log sources, develop detections, and create dashboards that drive visibility and response. This is an opportunity to grow your technical depth while making a measurable impact on the organization\'s security posture.

• SIEM Platform Support- Assist in the implementation, administration, and ongoing optimization of the organization\'s SIEM platform (e.g., Google Security Operations (SecOps), Splunk, Exabeam, Microsoft Sentinel).


• Cribl Development- Support the design and maintenance of Cribl pipelines, including data routing, filtering, enrichment, and performance optimization.


• Log Integration- Build and maintain integrations for standard and custom log sources using APIs, agents, syslog, and cloud-native logging services.


• Detection Enablement- Partner with Cybersecurity Operations to develop and refine SIEM use cases, correlation rules, and alerting logic.


• Dashboards & Reporting- Create and enhance dashboards, searches, and reports to support Security Operations Center (SOC) activities and threat hunting.


• Documentation- Contribute to documentation of SIEM architecture, data flows, onboarding processes, and operational procedures.


• Data Quality Assurance- Help establish and monitor data quality standards to ensure reliable and accurate telemetry.


• Cross-Team Collaboration- Work with IT, Cloud, and Application teams to onboard new systems and ensure proper logging coverage.


• Incident Support- Provide support during security incidents, assisting with investigation and analysis efforts.


• Continuous Learning- Stay current on SIEM technologies, security analytics, and observability trends to enhance capabilities.

What You’ll Bring

• Education- Bachelor’s degree or equivalent professional experience required.


• Experience- Minimum of 3-5 years in IT or engineering, with at least 2-3 years focused on SIEM, logging, or security analytics.


• SIEM Fundamentals- Hands-on experience working with SIEM platforms such as Google SecOps (Chronicle), Splunk, Exabeam, or Microsoft Sentinel.


• Cribl Exposure- Experience working with Cribl, including pipeline configuration and log onboarding, preferred.


• Data Integration Skills- Familiarity with integrating log sources using APIs, syslog, or agents.


• Analytics & Visualization- Experience building dashboards, alerts, and queries to support security monitoring and operations.


• Security Knowledge- Understanding of common log sources, including endpoint, network, identity, cloud, SaaS (Software as a Service), and application logs.


• Collaboration & Communication- Ability to work effectively with cross-functional teams and communicate technical concepts clearly.


• Technical Foundation- Exposure to scripting or query languages (e.g., SPL, KQL, Python, Regex) and cloud platforms (AWS, Azure, GCP) is a plus.


• Problem Solving & Growth Mindset- Strong analytical skills, attention to detail, and a proactive approach to learning and improvement.