Lead SOC Engineer - SIEM

About the role

The SOC Lead Engineer, SIEM plays a key role in the Security Operations Center, covering technical leadership, SIEM architecture design and pre-sales support. The role oversees SIEM solutions, guides senior and junior engineers across multiple environments and customers, and helps estimate SIEM licenses. It reports to the Senior SOC Engineering & Architecture Manager and suits a seasoned professional with over a decade of SIEM experience.

Key responsibilities

• Lead the technical operation and management of SIEM tools such as Splunk, Sentinel, LogRhythm, Qradar and FortiSIEM.
• Oversee the log collection layer, focusing on tools like CRIBL, and keep SIEM systems healthy through regular checks and maintenance.
• Manage SIEM licenses: forecast, track usage and coordinate with sales on estimations and renewals.
• Optimize SIEM telemetry for efficient, accurate data collection, correlation and reporting.
• Develop and enforce logging standards across customers, systems and platforms.
• Mentor SOC engineers on SIEM services and log management.
• Take part in pre-sales activities to give technical expertise and license estimations.
• Work with the SOC Engineering & Architecture Manager on SIEM architecture strategy and initiatives, and help improve SOC processes.
• Report regularly on SIEM services, SOC operations and license management to stakeholders.

Required profile

• Certified Information Systems Security Professional (CISSP).
• Certified Information Security Manager (CISM).
• Splunk Certified Architect or a similar SIEM certification is a must.
• Bachelor's degree in computer science, information technology, cybersecurity or a related field.
• At least 10 years of experience in SIEM and SOC operations, with significant SIEM management and architecture experience.
• Prior leadership role in a SOC or similar cybersecurity environment.

Required skills

• Hands-on experience with Splunk, Sentinel, LogRhythm, FortiSIEM and CRIBL.
• Demonstrated pre-sales experience estimating SIEM licenses.
• Strong understanding of SOC operations, cybersecurity principles and best practices.
• Cloud certifications such as AWS, Google or Microsoft Azure Solutions Architect are advantageous; networking certifications like CCNA or CCNP are also helpful.