SIEM Engineer II: Detection, Dashboards & Incident Support

Kirkland & Ellis; Chicago (IL); On-site; USD 133,000 - 166,000; Full time

Benefits offered by this job

Comprehensive healthcare

Paid time off

Retirement plan

Learning & development opportunities

Job summary

Kirkland & Ellis is seeking a hands-on SIEM Engineer II to deepen expertise in SIEM platforms and help build scalable, data-driven detection capabilities. You will support ingestion, normalization, and enrichment of security telemetry while aiding detection engineering, incident response, and analytics.

Collaborate with Cybersecurity Operations, IT, Infrastructure, Cloud, and Applications teams to onboard log sources and develop detections.

Qualifications

• Bachelor's degree or equivalent professional experience.
• 3–5 years IT/engineering experience with 2–3 years in SIEM, logging or security analytics.
• Hands-on experience with SIEM platforms: Splunk, Chronicle, Exabeam or Sentinel.

Responsibilities

• Assist in SIEM platform implementation, administration and optimization.
• Develop and maintain Cribl pipelines for routing, enrichment and performance.
• Build and maintain log integrations using APIs, syslog and agents.
• Develop SIEM use cases, correlation rules and alerting logic.
• Create dashboards and reports to support SOC operations and threat hunting.
• Document SIEM architecture, data flows and onboarding processes.
• Monitor data quality and telemetry accuracy.
• Collaborate with IT, Cloud and Application teams to onboard systems.
• Provide incident support and investigation assistance.
• Stay current with SIEM technologies and security analytics trends.

Skills

SIEM

Logging

Security analytics

Dashboards

Communication

Problem solving

Scripting

Cloud platforms

Education

Bachelor's degree or equivalent professional experience

Tools

Cribl

Splunk

Google SecOps (Chronicle)

Exabeam

Microsoft Sentinel

Job description

Kirkland & Ellis is seeking a hands-on SIEM Engineer II to deepen expertise in SIEM platforms and help build scalable, data-driven detection capabilities. You will support ingestion, normalization, and enrichment of security telemetry while aiding detection engineering, incident response, and analytics.

Collaborate with Cybersecurity Operations, IT, Infrastructure, Cloud, and Applications teams to onboard log sources and develop detections.