Security Platform / SIEM Engineer

What You Will Do

• Onboard client log sources (firewalls, Windows, Linux, cloud) into our SIEM . Write, test and tune detection rules mapped to MITRE ATT&CK, using Atomic Red Team and Caldera on our lab range
• Keep the pipeline healthy: ingestion, storage, updates, backups and 'no logs' alerts
• Support our SOC analysts when a detection fires, or fails to fire
• Build connectors, parsers and dashboards as new clients arrive( Multi Tanent environment)
• Take part in the on-call rota
• Run purple-team cycles and threat hunts, and turn what you find into detections, including for AI-driven attacks
• Nice to have Sigma rules; Atomic Red Team or Caldera
• FIM, YARA Rules
• Microsoft 365 / Entra ID or AWS log sources
• Security certifications (e.g. BTL1, GCIH, Fortinet NSE)
• Desired Candidate Profile 3+ years in SIEM engineering, security engineering or SOC operations, writing detection rules yourself
• Solid Linux, Docker and scripting (bash, Python)
• Good knowledge of firewall, Windows and Linux logs and of MITRE ATT&CK. Hands-on threat hunting and knowledge of red-team / adversary-emulation tools (Atomic Red Team, Caldera or similar)
• Understanding of vulnerabilities, defence methods and how attackers use AI (AI-written phishing, deepfakes, prompt injection, AI-assisted red teaming), and of how AI can speed up detection engineering
• Strong written and verbal English skills