Lead SOC Engineer SIEM

About the role

The Lead SOC Engineer – SIEM will provide technical leadership within the Security Operations Center, designing SIEM architectures and supporting pre‑sales activities. Reporting to the Senior SOC Engineering & Architecture Manager, the role oversees multiple environments and guides both senior and junior engineers.

Key responsibilities

• Lead technical operations and management of SIEM platforms such as Splunk, Microsoft Sentinel, LogRhythm, Qradar and FortiSIEM.
• Maintain and monitor the log‑collection layer, focusing on tools like CRIBL.
• Ensure health, performance and regular maintenance of all SIEM systems.
• Forecast, track and coordinate SIEM license usage, estimations and renewals.
• Optimize telemetry for accurate data collection, correlation and reporting.
• Develop and enforce logging standards across customers and platforms.
• Mentor SOC engineers in issue resolution related to SIEM services and log management.
• Participate in pre‑sales engagements, providing technical expertise and license estimations.
• Collaborate on SIEM architecture strategy and continuous process improvements.
• Produce regular reports on SIEM services, SOC operations and license management.

Required profile

• More than 10 years of hands‑on experience in SIEM operations and SOC environments.
• Proven technical leadership in fast‑paced, complex settings.
• Experience in pre‑sales activities, especially SIEM license estimation.
• Strong understanding of cybersecurity principles and SOC best practices.
• Excellent problem‑solving abilities and decision‑making under pressure.
• Effective communication and mentorship skills.

Required skills

• Splunk
• Microsoft Sentinel
• LogRhythm
• Qradar
• FortiSIEM
• CRIBL