Senior Information Security Engineer - SIEM & SOC Tools

Placements24; East London; Hybrid; ZAR 900,000 - 1,600,000; Full time

Benefits offered by this job

Health benefits

Retirement benefits

Performance incentives

Professional development / certs

Remote work

Job summary

Placements24 is seeking a Senior Information Security Engineer in South Africa to design, implement, and maintain SIEM and SOAR platforms, ensuring rapid detection and response to threats across the organization in a fully remote role.

You will lead incident investigations, develop automation playbooks, tune correlations, and collaborate with IT and development teams, with a strong emphasis on log normalization, threat detection, and security analytics.

Qualifications

• Bachelor's degree in Computer Science, IT, Cybersecurity or equivalent.
• 5+ years in information security with at least 3 years in SIEM administration, engineering, or SOC tool management.
• Experience deploying, configuring, and managing enterprise-grade SIEM solutions.
• Hands-on experience with SOAR platforms and automation playbooks.
• Strong log analysis, threat detection techniques and incident response processes.
• Proficiency in scripting languages (Python, PowerShell, Bash) for automation.
• Experience with data ingestion, parsing and normalization from various log sources.
• Solid networking, OS knowledge and security vulnerability understanding.
• Excellent analytical, problem-solving and documentation skills.
• Relevant security certifications (e.g., Splunk Admin/Architect, GSEC, GCIH) desirable.

Responsibilities

• Design, deploy, configure, and maintain SIEM and SOAR platforms.
• Develop and optimize correlation rules, alerts, dashboards, and reports.
• Integrate various security tools and log sources into the SIEM platform.
• Develop and automate security workflows and playbooks using the SOAR platform.
• Respond to and investigate complex security incidents escalated from the SOC.
• Perform threat hunting using SIEM data and other security tools.
• Provide expert guidance and support to SOC analysts and security teams.
• Conduct performance tuning and capacity planning for SIEM/SOAR infra.
• Stay current with security threats, vulnerabilities and technologies.
• Document configurations, rules, playbooks, and procedures.
• Collaborate with IT and development for effective log collection and normalization.

Skills

SIEM administration

SOC tooling management

Threat detection techniques

Incident response processes

Scripting (Python/PowerShell/Bash)

Log analysis

Automation & playbooks

Data ingestion & normalization

Analytical thinking

Documentation & communication

Education

Bachelor's degree in Computer Science / IT / Cybersecurity (or equivalent)

Tools

Splunk

QRadar

LogRhythm

Palo Alto Cortex XSOAR

Job description

About the Role

Our client, a leading online retailer, is looking for a highly skilled Senior Information Security Engineer with expertise in Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) tools. This is a fully remote position, allowing you to work from any location within South Africa. You will be responsible for the design, implementation, tuning, and maintenance of our client's SIEM and SOAR platforms, as well as other security monitoring tools. Your role will be critical in enhancing the organization's ability to detect, investigate, and respond to security threats efficiently and effectively. The ideal candidate is proactive, technically adept, and passionate about leveraging technology to improve security operations.

Key Responsibilities

• Design, deploy, configure, and maintain SIEM and SOAR platforms (e.g., Splunk, QRadar, LogRhythm, Palo Alto Cortex XSOAR).
• Develop and optimize correlation rules, alerts, dashboards, and reports within the SIEM system.
• Integrate various security tools and log sources into the SIEM platform.
• Develop and automate security workflows and playbooks using the SOAR platform.
• Respond to and investigate complex security incidents escalated from the SOC.
• Perform threat hunting activities by leveraging SIEM data and other security tools.
• Provide expert technical guidance and support to SOC analysts and other security team members.
• Conduct performance tuning and capacity planning for SIEM and SOAR infrastructure.
• Stay current with the latest security threats, vulnerabilities, and security technologies.
• Document SIEM/SOAR configurations, rules, playbooks, and operational procedures.
• Collaborate with IT and development teams to ensure effective log collection and data normalization.

Requirements

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
• Minimum of 5 years of experience in information security, with at least 3 years focused on SIEM administration, engineering, or SOC tool management.
• Proven experience in deploying, configuring, and managing enterprise-grade SIEM solutions.
• Hands-on experience with SOAR platforms and developing automation playbooks.
• Strong understanding of log analysis, threat detection techniques, and incident response processes.
• Proficiency in scripting languages such as Python, PowerShell, or Bash for automation.
• Experience with data ingestion, parsing, and normalization from various log sources.
• Solid understanding of networking, operating systems, and common security vulnerabilities.
• Excellent analytical, problem-solving, and troubleshooting skills.
• Strong communication and documentation skills.
• Relevant security certifications (e.g., Splunk Certified Administrator/Architect, GSEC, GCIH) are highly desirable.
• Experience with cloud-native security monitoring tools is a plus.

Benefits

Our client offers a competitive salary, comprehensive health and retirement benefits, performance incentives, and excellent opportunities for professional development and certifications. This role offers the flexibility of working remotely from anywhere in South Africa.