Lead SOC Engineer (SIEM)

About the role

The Lead SOC Engineer (SIEM) will provide technical leadership for the Security Operations Center, designing SIEM architectures and supporting pre‑sales activities. Reporting to the Senior SOC Engineering & Architecture Manager, the role requires over a decade of hands‑on SIEM experience.

Key responsibilities

• Lead technical operations and management of SIEM platforms such as Splunk, Sentinel, LogRhythm, Qradar and FortiSIEM.
• Oversee log collection layer maintenance, focusing on tools like CRIBL, and ensure health of SIEM systems through regular checks.
• Manage SIEM license forecasting, tracking, and coordination with sales for estimations and renewals.
• Develop and enforce logging standards across customers and platforms.
• Mentor SOC engineers, participate in pre‑sales estimations, and collaborate on architecture strategies.

Required profile

• Bachelor's degree in Computer Science, IT, Cybersecurity or related field.
• Minimum 10 years of experience in SIEM and SOC operations, with proven leadership in a SOC environment.
• Relevant certifications such as CISSP, CISM, Splunk Certified Architect, and cloud architecture certifications.

Required skills

• Hands‑on expertise with Splunk, Microsoft Sentinel, LogRhythm, FortiSIEM, Qradar.
• Experience with log collection and normalization tools, specifically CRIBL.
• Strong technical leadership, problem‑solving under pressure, and mentorship abilities.