Principal SIEM Engineer

🕒 vor 1 Monat

🇺🇸 Vereinigte Staaten – Remote

💵 $128.600 - $225.000 / Jahr

⏰ Vollzeit

🔴 Experte

👷🏻‍♀️ Ingenieur

👻 Geisterscore 3%

Was es bedeutet: die Wahrscheinlichkeit, dass für diese Stelle niemand wirklich einstellt.So liest du es: 60 % oder höher heißt, wir halten das für einen Geisterjob. Niedrigere Werte sind weniger bedenklich.Warum dieser Wert:

• Seit 40 Tagen offen.
• Stellen bei diesem Unternehmen werden meist in 31 Tagen besetzt.

Jetzt Bewerben

Ähnliche Remote-Jobs finden

Center for Internet Security

WebsiteLinkedInAlle Stellen

201 - 500 Mitarbeiter

Gegründet 2000

🔒 Cybersecurity

📋 Compliance

🤖 Künstliche Intelligenz

Cybersecurity • Compliance • Artificial Intelligence

Das Center for Internet Security (CIS) ist eine unabhängige, gemeinnützige Organisation, die sich der Förderung von Best Practices in der Cybersicherheit widmet und Organisationen dabei unterstützt, ihre Systeme vor Cyberbedrohungen zu schützen. CIS bietet eine Vielzahl von Ressourcen, darunter die CIS Critical Security Controls und CIS Benchmarks, um Organisationen bei der Implementierung effektiver Sicherheitsmaßnahmen zu unterstützen. Ihr Ziel ist es, Vertrauen in die vernetzte Welt zu schaffen, indem die Cybersicherheitslage sowohl öffentlicher als auch privater Infrastrukturen verbessert wird.

Beschreibung

• Develop and maintain SOAR content, including case management configuration, escalation playbooks, and automations • Author and version playbook templates, including bulk escalation templates for multiple source types, and coordinate changes with SOC leadership • Configure and maintain the SIEM, including relay build and joining, log source tagging, regular expressions, parsing validation, and alert definitions • Build and tune detection content across Suricata, CrowdStrike, Albert, endpoint, firewall, and network telemetry • Troubleshoot the ingestion and case creation pipeline end to end and own issues through resolution as the tier 2 escalation point • Participate in platform incident response and maintain alerting and routing for the after-hours on-call rotation • Manage technical escalations with the SIEM and SOAR vendor, diagnose vendor defects and regressions, and design remediation • Deliver engineering steps for MDR and SOC-as-a-service customer onboarding, including use case verification, relay build, log collection verification, parsing validation, alert definitions, SOAR automation, user acceptance testing, and health monitoring • Build connector and log source integrations and automate repeatable buildout • Manage, develop, and tune queries, alerts, inputs, and scripts across cyber defense offerings and operations infrastructure • Build operational and customer-facing SIEM and SOAR dashboards using live SOAR case data • Audit ingest volume and re-engineer source volume and filtering to remain within contractual caps • Maintain escalation runbooks, onboarding guides, and log source documentation • Provide technical input to Product and leadership on SIEM/SOAR platform decisions, vendor renewals, ingest ceilings, licensing, and capabilities • Perform other assigned tasks and responsibilities

🎯 Anforderungen

• Bachelor’s degree in Information Technology, Cybersecurity, or a related field • 7+ years’ experience deploying, engineering, and operating enterprise security monitoring and logging platforms, including log source onboarding, parsing, and detection content development • 7+ years’ experience in security operations or security engineering supporting a security operations center • 5+ years’ experience building SOAR automation in a production environment, including case management content, escalation playbooks, and integration with ticketing systems and third-party APIs • Experience troubleshooting a log pipeline end to end and resolving faults • Experience serving as a technical escalation point and managing platform vendor escalations • Experience using or producing Cyber Threat Intelligence for network defense • Willingness to participate in an after-hours on-call rotation • Experience analyzing data from firewalls, intrusion detection and prevention systems, data loss prevention, endpoint security tools, host-based logs, network logs, syslog, and other sources • Proficiency in security log data enrichment, regular expressions (RegEx), SQL, Python, and analytic techniques • Experience with network forensics and Wireshark, PCAP, tcpdump, and MITRE ATT&CK • Experience with cloud technologies and providers such as Amazon, Azure, and Google • Solid client-facing and internal communication skills • Solid organizational skills, attention to detail, and multitasking • Must be authorized to work in the United States • Advanced degree in Computer Science, Business, or related field (plus) • Hands-on SIEM and SOAR experience (plus) • Experience onboarding customers to managed detection and response or SOC-as-a-service offerings (plus) • Experience building relays or log collectors and joining them to a SIEM, including TLS termination and client-side collection configuration (plus) • Experience developing detection content for network intrusion detection, endpoint detection and response, or firewall telemetry (plus) • Experience managing ingest volume against a contracted licensing or volume ceiling (plus) • Experience mentoring engineers and cross-training peers on a SIEM or SOAR platform (plus) • Relevant industry certifications such as CISSP, GCIH, GCIA, GMON (plus) • Experience in incident response, vulnerability management, and security operations (plus) • Experience in vendor management and relationships (plus) • Familiarity with Agile DevOps and project management (plus) • Strong knowledge of scripting languages such as Python and PowerShell (plus)

🏖️ Vorteile

• Tier 2 after-hours on-call rotation participation • Inclusive work environment valuing diverse backgrounds, experiences, and views • Additional years of relevant experience or a combination of an Associate’s degree or equivalent and relevant experience may substitute for the Bachelor’s degree

📊 Überprüfen Sie Ihre Lebenslauf-Bewertung für diese Stelle

Verbessern Sie Ihre Chancen auf ein Vorstellungsgespräch, indem Sie Ihre Lebenslauf-Bewertung vor der Bewerbung überprüfen.

Lebenslauf hochladen