Senior SOC Engineer – SIEM (Splunk)

About the role

The Senior SOC Engineer will lead the management of Splunk SIEM and UEBA services within the Security Operations Center. The role focuses on onboarding new log sources, optimizing telemetry, performing system updates, and ensuring high‑performance SIEM operations aligned with business requirements.

Key responsibilities

• Manage and operate Splunk SIEM services in a SOC environment.
• Design and implement scalable Splunk‑based SIEM solutions following best practices.
• Define data ingestion strategies, parsing logic, and correlation rules.
• Onboard new log sources and ensure proper integration.
• Monitor, troubleshoot, and resolve issues with critical log sources.
• Optimize telemetry for improved data collection and reporting.
• Collaborate with SOC and threat‑intelligence teams to develop detection use cases.
• Create dashboards, alerts, and reports for proactive threat monitoring.
• Perform system updates, version upgrades, and feature rollouts.
• Maintain CIM compliance, field extractions, and data normalization.
• Evaluate and deploy Splunk apps and add‑ons as needed.
• Document SIEM workflows, configurations, and operational procedures.

Required profile

• Profound knowledge and hands‑on experience with Splunk SIEM, UEBA and related technologies such as CRIBL.
• Strong understanding of SOC workflows, MITRE ATT&CK framework and threat detection methodologies.
• Ability to correlate data across multiple sources to identify patterns and anomalies.
• Solid cloud and network technology expertise for efficient log source onboarding.
• Proven technical capabilities in a fast‑paced SOC environment.
• Excellent problem‑solving skills and ability to make decisions under pressure.
• Effective collaboration and communication skills with internal teams and customers.

Required skills

• Splunk SIEM and UEBA (Splunk Certified Administrator).
• SPL (Search Processing Language) for complex queries, dashboards and reports.
• Scripting: Python, Bash, PowerShell.
• Cloud platforms: AWS, Google Cloud, Azure (relevant certifications preferred).
• Security certifications: CISSP, GIAC (preferred).
• Experience with CRIBL and Splunk apps/add‑ons.