Principal SIEM Engineer

Job not on LinkedIn

🔥 0 minutes ago

🇺🇸 United States – Remote

💵 $128.6k - $225k / year

⏰ Full Time

🔴 Lead

👷🏻‍♀️ Engineer

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Center for Internet Security

WebsiteLinkedInAll Job Openings

201 - 500 employees

Founded 2000

🔒 Cybersecurity

📋 Compliance

🤖 Artificial Intelligence

Cybersecurity • Compliance • Artificial Intelligence

Center for Internet Security is an organization dedicated to enhancing the cybersecurity posture of businesses and individuals. It provides resources and tools focused on improving baseline cybersecurity measures, encouraging adherence to best practices, and ensuring compliance with privacy regulations. Their mission involves promoting improved security and resilience through collaboration and the sharing of knowledge and resources.

📋 Description

• Develop and maintain SOAR content, including case management configuration, escalation playbooks, and automations • Author and version playbook templates, including bulk escalation templates for multiple source types, and coordinate changes with SOC leadership • Configure and maintain the SIEM, including relay build and joining, log source tagging, regular expressions, parsing validation, and alert definitions • Build and tune detection content across Suricata, CrowdStrike, Albert, endpoint, firewall, and network telemetry • Troubleshoot the ingestion and case creation pipeline end to end and own issues through resolution as the tier 2 escalation point • Participate in platform incident response and maintain alerting and routing for the after-hours on-call rotation • Manage technical escalations with the SIEM and SOAR vendor, diagnose vendor defects and regressions, and design remediation • Deliver engineering steps for MDR and SOC-as-a-service customer onboarding, including use case verification, relay build, log collection verification, parsing validation, alert definitions, SOAR automation, user acceptance testing, and health monitoring • Build connector and log source integrations and automate repeatable buildout • Manage, develop, and tune queries, alerts, inputs, and scripts across cyber defense offerings and operations infrastructure • Build operational and customer-facing SIEM and SOAR dashboards using live SOAR case data • Audit ingest volume and re-engineer source volume and filtering to remain within contractual caps • Maintain escalation runbooks, onboarding guides, and log source documentation • Provide technical input to Product and leadership on SIEM/SOAR platform decisions, vendor renewals, ingest ceilings, licensing, and capabilities • Perform other assigned tasks and responsibilities

🎯 Requirements

• Bachelor’s degree in Information Technology, Cybersecurity, or a related field • 7+ years’ experience deploying, engineering, and operating enterprise security monitoring and logging platforms, including log source onboarding, parsing, and detection content development • 7+ years’ experience in security operations or security engineering supporting a security operations center • 5+ years’ experience building SOAR automation in a production environment, including case management content, escalation playbooks, and integration with ticketing systems and third-party APIs • Experience troubleshooting a log pipeline end to end and resolving faults • Experience serving as a technical escalation point and managing platform vendor escalations • Experience using or producing Cyber Threat Intelligence for network defense • Willingness to participate in an after-hours on-call rotation • Experience analyzing data from firewalls, intrusion detection and prevention systems, data loss prevention, endpoint security tools, host-based logs, network logs, syslog, and other sources • Proficiency in security log data enrichment, regular expressions (RegEx), SQL, Python, and analytic techniques • Experience with network forensics and Wireshark, PCAP, tcpdump, and MITRE ATT&CK • Experience with cloud technologies and providers such as Amazon, Azure, and Google • Solid client-facing and internal communication skills • Solid organizational skills, attention to detail, and multitasking • Must be authorized to work in the United States • Advanced degree in Computer Science, Business, or related field (plus) • Hands-on SIEM and SOAR experience (plus) • Experience onboarding customers to managed detection and response or SOC-as-a-service offerings (plus) • Experience building relays or log collectors and joining them to a SIEM, including TLS termination and client-side collection configuration (plus) • Experience developing detection content for network intrusion detection, endpoint detection and response, or firewall telemetry (plus) • Experience managing ingest volume against a contracted licensing or volume ceiling (plus) • Experience mentoring engineers and cross-training peers on a SIEM or SOAR platform (plus) • Relevant industry certifications such as CISSP, GCIH, GCIA, GMON (plus) • Experience in incident response, vulnerability management, and security operations (plus) • Experience in vendor management and relationships (plus) • Familiarity with Agile DevOps and project management (plus) • Strong knowledge of scripting languages such as Python and PowerShell (plus)

🏖️ Benefits

• Tier 2 after-hours on-call rotation participation • Inclusive work environment valuing diverse backgrounds, experiences, and views • Additional years of relevant experience or a combination of an Associate’s degree or equivalent and relevant experience may substitute for the Bachelor’s degree