About the Role Hands-on Senior Security Engineer to onboard environments into our SOC, build and tune detection use cases, and keep our SIEM and data pipelines healthy. You will work across Splunk, Microsoft Sentinel and Cribl, and collaborate with the SOC, Detection and Platform teams.
Key Responsibilities
SOC-to-SIEM onboarding – integrate SIEM, EDR, IAM and DLP log sources into stable SOC operations.
Detection engineering – design, test and tune MITRE ATT&CK-aligned; use cases to improve fidelity and reduce false positives.
Log parsing and normalisation – parse, normalise (CIM/ASIM) and enrich raw logs so they are ready for search and detection.
Data pipeline management – use Cribl Stream/Edge to route, filter and enrich data while reducing ingestion noise and cost.
Platform health – maintain Splunk and Sentinel health, tuning, dashboards and new data connector onboarding.
Collaboration and documentation – partner with SOC,
CTI and Platform teams while maintaining clear, audit-ready documentation.
What You Bring
Solid use case building and detection tuning skills (MITRE ATT&CK;).
Solid log parsing and normalisation experience.
Hands-on with Splunk (SPL) and Microsoft Sentinel (KQL).
Experience with Cribl data pipelines (Stream / Edge).
Knowledge of EDR, IAM and DLP log sources.
Scripting (Python / PowerShell) is a plus.
Qualifications
Bachelor’s degree in Computer Science, IT or Information Security.
Splunk Core Certified Power User or Splunk Enterprise Certified Admin; Cribl Certified Admin – Stream or Cribl Certified Admin – Edge; and Microsoft Certified: Security Operations Analyst Associate (SC-200) for Microsoft Sentinel certifications will be a plus