Job Description - SIEM Senior Engineer

Role Overview

The SIEM Senior Engineer is responsible for hands-on engineering, alert enrichment, and monitoring of security alerts using Splunk. This role focuses on building high-quality detections, enriching alerts with meaningful context, and improving SOC analyst efficiency by reducing false positives and improving signal quality. The role works closely with SOC Analysts, SIEM Leads, and Security Engineering teams.

Key Responsibilities

• Engineer, maintain, and tune Splunk-based SIEM alerts and correlation rules.
• Monitor security alerts to ensure accuracy, relevance, and operational readiness.
• Continuously tune alerts to improve signal-to-noise ratio and reduce false positives.
• Implement alert enrichment using identity, asset, vulnerability, and threat intelligence data.
• Ensure alerts contain actionable context such as user, asset, privilege, and business impact.
• Support Splunk log onboarding, data normalization, and CIM compliance.
• Optimize SPL searches, dashboards, and saved searches.
• Support L2/L3 troubleshooting for SIEM alerts and ingestion issues.
• Develop detection use cases aligned to the MITRE ATT&CK framework.
• Maintain SOPs, runbooks, and SIEM documentation.

Required Skills & Experience

• 4-7 years of experience in SIEM, SOC, or Security Engineering roles.
• Strong hands-on experience with Splunk Enterprise or Splunk ES.
• Proven experience in SIEM alert creation, tuning, and enrichment.
• Strong understanding of security telemetry across endpoint, network, cloud, and IAM.
• Proficiency in SPL (Search Processing Language).
• Understanding of SOC workflows and incident triage.
• Familiarity with the MITRE ATT&CK framework.

Preferred Qualifications

• Experience integrating Splunk with IAM, CMDB, vulnerability, and threat intelligence tools.
• Exposure to SOAR platforms and automated response workflows.
• Scripting experience using Python or PowerShell.
• Experience working in regulated environments such as healthcare or financial services.
• Relevant Splunk or security certifications.