Lead SOC Engineer (SIEM)

About the role

The Lead SOC Engineer (SIEM) will provide technical leadership for the Security Operations Center, designing SIEM architectures, managing day‑to‑day operations and supporting pre‑sales activities. Reporting to the Senior SOC Engineering & Architecture Manager, you will mentor engineers and ensure the health of multiple SIEM platforms across diverse customer environments.

Key responsibilities

• Lead technical operations and management of SIEM tools such as Splunk, Microsoft Sentinel, LogRhythm, QRadar and FortiSIEM.
• Maintain the log‑collection layer, focusing on CRIBL and related components.
• Monitor SIEM health, perform regular maintenance and optimise telemetry for accurate data collection.
• Forecast, track and coordinate SIEM license usage, supporting sales and renewal processes.
• Develop and enforce logging standards across all customers and platforms.
• Mentor senior and junior SOC engineers, guiding issue resolution and best‑practice adoption.
• Participate in pre‑sales engagements, providing technical estimates for SIEM licences and architectures.
• Collaborate on SIEM architecture strategy and continuous process improvements.

Required profile

• Minimum 10 years of hands‑on experience in SIEM operations and SOC environments.
• Proven technical leadership in fast‑paced, complex settings.
• Experience delivering pre‑sales technical support and licence estimations.
• Strong understanding of cybersecurity principles and SOC best practices.

Required skills

• Splunk
• Microsoft Sentinel
• LogRhythm
• IBM QRadar
• FortiSIEM
• CRIBL log‑collection platform