Lead SOC Engineer – SIEM

About the role

The Lead SOC Engineer (SIEM) will provide technical leadership within the Security Operations Center, designing SIEM architectures and supporting pre‑sales activities. Reporting to the Senior SOC Engineering & Architecture Manager, you will mentor engineers and ensure the health of multiple SIEM platforms across diverse customer environments.

Key responsibilities

• Lead operation and management of SIEM tools such as Splunk, Microsoft Sentinel, LogRhythm, QRadar and FortiSIEM.
• Maintain and optimise the log collection layer, including CRIBL, to guarantee reliable telemetry.
• Monitor SIEM health, perform regular maintenance, and enforce logging standards for all customers.
• Manage SIEM licensing – forecast usage, track consumption and coordinate renewals with sales.
• Provide technical expertise and estimations during pre‑sales engagements.
• Collaborate on SIEM architecture strategy and drive continuous process improvements.
• Mentor junior SOC engineers and deliver accurate reporting on SOC and SIEM performance.

Required profile

• Minimum 10 years of hands‑on experience with SIEM operations.
• Proven technical leadership in fast‑paced security environments.
• Strong problem‑solving abilities and capacity to make decisions under pressure.
• Experience guiding and developing engineering teams.

Required skills

• FortiSIEM
• CRIBL
• Microsoft Sentinel
• LogRhythm
• Splunk
• QRadar