SIEM Detection Engineer
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Managed SIEM Detection Engineer delivering detection strategy, migration, and optimization services. Helping Expel customers strengthen co-managed security monitoring across SIEM platforms.
Responsibilities:
- Deliver end-to-end professional services engagements, including detection strategy, MITRE ATT&CK assessment, SIEM optimization and integrations, SOAR playbook development, and custom log parsing
- Develop and validate detection content for defined security use cases during onboarding and as environments evolve
- Optimize SIEM performance and cost by tuning detections, reducing alert noise, and improving ingestion efficiency
- Contribute to Expel’s proprietary professional services detection library
- Translate detection logic between SIEM platforms and write custom parsers for standard and non-standard log sources
- Partner with Detection Engineering and the SOC to hand off environments for co-managed operations
- Work with SOC analysts to improve rule and alert fidelity and actionability
- Track the evolving threat landscape and turn it into new detection development
- Contribute repeatable processes, templates, and tooling to improve delivery quality and consistency
Requirements:
- Hands-on SIEM expertise across Splunk, Microsoft Sentinel, and/or CrowdStrike NG SIEM, including architecture, data ingestion, and detection rule development
- 3+ years with detection and response tooling, particularly SIEM, SOAR, and EDR
- 3+ years writing, deploying, and tuning custom detections using common datasets such as Windows Event Logs, auditd, and CloudTrail
- SIEM migration experience translating detection logic between platforms and re-pointing log sources
- Working knowledge of attacker tactics, techniques, and the MITRE ATT&CK framework
- Fundamentals across Windows, macOS, and Linux
- Networking basics, including TCP/IP and OSI
- Working knowledge of cloud IAM models and platforms
- Basic proficiency with Python, Go, or similar
- Comfort using Git/GitHub for version control of detection content, scripts, and templates
- Curiosity, strong ownership, and appetite for growth
- Willingness to travel up to 20%
- Must be authorized to work in the United States
- Immigration visa sponsorship is not currently available
- Preferred/bonus: SIEM or vendor certifications; Sigma; detection-as-code and CI/CD; industry security certifications; bachelor’s degree in Computer Science or Information Security
Benefits:
- Bonus eligibility
- Equity
- Unlimited PTO
- Work location flexibility
- Up to 24 weeks of parental leave
- Really excellent health benefits
- Professional development runway
- Exposure to complex, high-stakes detection and SIEM problems
- Career growth through ownership of meaningful outcomes
- Ground-floor opportunity in a new professional services function
Similar Jobs
Project Engineer II - SRM Development
Project Engineer II leading solid rocket motor design, manufacturing, and delivery projects. Coordinating integrated teams, schedules, budgets, resources, and technical customer requirements for aerospace and defense products.
Senior MQA Engineer
Senior MQA Engineer testing web-based prescription-access software for Newfire Global Partners’ digital-health client. Performing API, regression, release, exploratory, and manual application testing.
Service Desk Engineer
Service Desk Engineer delivering managed IT and cybersecurity services for NetCov clients. Troubleshooting infrastructure, optimizing systems, and leading managed-services engineers.
L1 – Reports Engineer
L1 Reports Engineer supporting customers of Boardwise’s board-management SaaS. Creating and adapting Handlebars.js reports while troubleshooting software configuration and support tickets.
Forward Deployed Engineer
Forward Deployed Engineer supporting LiteLLM, the open-source AI Gateway trusted by major companies. Owning support tickets, diagnosing root causes, reproducing issues, and submitting bug-fix pull requests.
Structural Forensic Engineer
Structural forensic engineer investigating failures, property damage, and insurance claims for TRC Worldwide Engineering. Preparing expert reports and supporting client relationships and business development.
Senior Solutions and Technology Engineer
Senior engineer researching technologies and designing material-handling systems for PeakLogix customers. Developing CAD layouts, automated solutions, and technical proposals for pre-sale execution.
Senior Geological/Geotechnical Engineer
Senior geological/geotechnical engineer leading mining and transportation projects for BGC Engineering, an applied earth sciences consultancy. Managing technical delivery, field programs, project teams, mentoring, client service, and business development in Alaska.
Intermediate Civil-Geotechnical Engineer
Civil-geotechnical engineer designing transportation infrastructure and earth retention systems for BGC, an applied earth sciences consultancy. Conducting investigations, field work, analysis, and technical reporting in Alaska.
Compiler Engineer
Compiler Engineer advancing Intel’s oneAPI offloading and SYCL infrastructure for CPUs, GPUs, and accelerators. Collaborating with LLVM and Intel teams on production compiler technology.
Advanced Consulting Engineer
Advanced Consulting Engineer helping Tanium customers adopt endpoint management and security solutions. Providing technical advisory, troubleshooting, knowledge transfer, and product guidance for complex or stalled deployments.
Forward Deployed Engineer
Forward Deployed Engineer building AI-native software for Asset Living’s property management operations. Owning full-stack products, integrations, automation, and measurable improvements across business functions.
Escalation Engineer
Escalation Engineer resolving critical Kubernetes and multi-cloud storage incidents for Everpure, a data-storage technology company. Bridging support and engineering through troubleshooting, bug fixes, and reliability improvements.
Staff Vulnerability Management Engineer
Staff engineer managing novel vulnerability disclosure and CVE operations for Chainguard’s secure open-source software supply chain. Coordinating industry bodies, maintainers, customers, and AI model vendors.
Staff Vulnerability Management Engineer
Staff engineer managing AI-discovered vulnerabilities for Chainguard, which builds hardened open-source software. Coordinating disclosures, CVEs, embargoes, and industry-wide supply-chain security efforts.
Staff Vulnerability Management Engineer
Staff engineer managing novel vulnerability disclosure and CVE coordination for Chainguard, which secures open-source software supply chains. Leading industry collaboration on AI-driven software security standards, embargoes, and response processes.
Endpoint Engineer
Endpoint Engineer supporting Falconwood’s DoD IT consulting and programmatic services for Navy enterprise workstations. Managing Azure, MECM, M365, hardware, software, and cybersecurity requirements.
Plumbing and Heating Engineer
Clean Energy Technician installing heat pumps, cylinders, and radiators for Aira’s sustainable home-energy systems. Training toward Heat Pump Installer progression while helping households reduce energy costs and carbon emissions.
Spares Engineer, Composite Materials Expert
Spares Engineer identifying and resolving out-of-production composite parts for ATEXIS, an aerospace and industrial engineering-support consultancy. Assessing operational risks and coordinating alternatives with stakeholders.
Lift Engineer
Lift Engineer servicing and repairing lifts across Cambridge for Stannah, a global access-solutions manufacturer. Maintaining safe operation across commercial, residential, and public sites.