Lead SOC Engineer (SIEM)

About the role

The Lead SOC Engineer (SIEM) is responsible for technical leadership, SIEM architecture design, and pre‑sales support within a Security Operations Center. Reporting to the Senior SOC Engineering & Architecture Manager, the role guides senior and junior engineers across multiple environments and customers.

Key responsibilities

• Lead technical operations and management of SIEM tools such as Splunk, Microsoft Sentinel, LogRhythm, Qradar and FortiSIEM.
• Maintain the log collection layer, focusing on CRIBL, and ensure health of SIEM systems through regular checks.
• Oversee SIEM license forecasting, usage tracking and coordinate renewals with sales.
• Optimize telemetry for efficient data collection, correlation and reporting.
• Develop and enforce logging standards across all customers and platforms.
• Mentor SOC engineers, resolve SIEM service issues and participate in pre‑sales estimations.
• Collaborate on SIEM architecture strategies and drive continuous process improvements.

Required profile

• Minimum 10 years of experience in SIEM and SOC operations, with proven leadership in a fast‑paced environment.
• Strong understanding of SOC processes, cybersecurity principles and best practices.
• Excellent written and verbal communication, with the ability to make decisions under pressure.

Required skills

• Hands‑on experience with Splunk, Microsoft Sentinel, LogRhythm, Qradar, FortiSIEM and CRIBL.
• Certifications: CISSP, CISM, Splunk Certified Architect (or equivalent SIEM certification).
• Cloud architecture knowledge: AWS, Google Cloud, Azure.
• Networking certifications such as CCNA or CCNP are advantageous.