Lead SOC Engineer (SIEM)

About the role

The Lead SOC Engineer (SIEM) will provide technical leadership for the Security Operations Center, designing SIEM architectures and supporting pre‑sales activities. Reporting to the Senior SOC Engineering & Architecture Manager, you will guide senior and junior engineers across multiple customer environments.

Key responsibilities

• Lead technical operations and management of SIEM platforms such as Splunk, Microsoft Sentinel, LogRhythm, Qradar and FortiSIEM.
• Oversee the log‑collection layer, ensuring tools like CRIBL are properly maintained.
• Monitor SIEM health, perform regular maintenance, and optimize telemetry for accurate data correlation.
• Manage SIEM licensing – forecast usage, track consumption, and coordinate renewals with sales.
• Develop and enforce logging standards across all customers and platforms.
• Mentor SOC engineers, providing guidance on issue resolution and best practices.
• Participate in pre‑sales engagements, delivering technical estimates for SIEM licenses and architectures.
• Collaborate with the SOC Engineering & Architecture Manager on architecture strategy and continuous process improvements.
• Produce regular reports on SIEM performance, SOC operations and license management.

Required profile

• Minimum 10 years (120 months) of hands‑on experience in SIEM operations.
• Proven technical leadership in a fast‑paced security environment.
• Demonstrated pre‑sales experience, especially in SIEM license estimation.
• Strong understanding of SOC operations, cybersecurity principles and best practices.

Required skills

• Splunk
• Microsoft Sentinel
• LogRhythm
• Qradar
• FortiSIEM
• CRIBL (log collection)