SIEM/SOAR Engineer

Staffing Spot, Inc.; Charlotte (NC); On-site; USD 140,000 - 180,000; Full time

Job summary

Staffing Spot, Inc. is seeking a Senior Cybersecurity professional focused on SIEM/SOAR production support with a strong emphasis on Splunk and IAM.

The role covers keeping security platforms running, resolving production issues, detecting threats, and automating responses. The candidate will provide strong L2/L3 production support in a regulated financial services environment, build and tune Splunk queries and SOAR playbooks, and work with Linux/Windows, SQL/Oracle, and related tooling.

Qualifications

• Minimum 5 years in SIEM/SOAR and production support.
• Hands-on Splunk experience with dashboards and alerts.
• Experience with IAM/MFA/access management.
• Strong Linux skills; Windows administration.
• Knowledge of SQL/Oracle databases and scripting.
• ITIL incident management and root cause analysis.
• Excellent communication and problem-solving.

Responsibilities

• Manage and optimize Splunk/SIEM/SOAR environments.
• Build Splunk queries, alerts, dashboards, detection rules, and SOAR playbooks.
• Monitor security events and troubleshoot production issues.
• Support IAM, MFA, authentication, and access management.
• Perform incident management, RCA, and service restoration.
• Work with Linux/Windows, SQL/Oracle, Ansible, Jenkins, OpenShift, Remedy, Dynatrace.
• On-call/off-hours support and 3 days onsite.

Skills

SIEM/SOAR

Linux

Windows

ITIL

Communication

Problem-solving

Incident management

On-call support

Tools

Splunk

SOAR

Remedy

Dynatrace

Ansible

Jenkins

OpenShift

SQL

Oracle

Tower/BladeLogic

GitHub

Job description

Key Responsibilities :

• Senior Cybersecurity / SIEM-SOAR Production Support role with a strong Splunk and IAM focus.


• Responsible for keeping security platforms running, troubleshooting production issues, detecting threats, and automating security response.


• Strong L2/L3 production support in a regulated financial-services environment.

Day-to-Day

• Manage and optimize Splunk/SIEM/SOAR.


• Build Splunk queries, alerts, dashboards, detection rules, and SOAR playbooks.


• Monitor security events and troubleshoot production issues.


• Support IAM, MFA, authentication, and access management.


• Perform incident management, RCA, and service restoration.


• Work with Linux/Windows, SQL/Oracle, Ansible, Jenkins, OpenShift, Remedy, Dynatrace.


• On-call/off-hours support and 3 days onsite.

Must-Haves

• 5 years SIEM/SOAR and production support


• Strong hands-on Splunk


• Strong IAM/MFA/access management


• Expert Linux, strong Windows


• SQL/Oracle


• Scripting: Unix/PowerShell


• Incident management, troubleshooting, and ITIL


• Strong communication and problem-solving

Plusses

• CISSP or cybersecurity certification


• Financial services/FinTech experience


• Cloud, DevOps/CI/CD, and networking experience


• Ansible, Jenkins, OpenShift, GitHub, Dynatrace


• Tower / BladeLogic