Lead SOC Engineer – SIEM & SOAR

About the role

The Lead SOC Engineer – SIEM & SOAR is responsible for delivering Splunk SIEM and SOAR management services within the Security Operations Center. You will work closely with internal and external teams to onboard log sources, optimise telemetry, and maintain system performance.

Key responsibilities

• Deliver Splunk SIEM/SOAR services, including onboarding new log sources and maintaining critical log integrations.
• Design and implement SOAR playbooks, integrate with ticketing (e.g., ServiceNow) and threat intelligence platforms.
• Perform regular system updates, troubleshoot issues, and ensure CIM compliance and optimal performance.
• Provide regular reports on SOC operations and contribute to architecture strategy.

Required profile

• Minimum 8 years of SOC experience with strong hands‑on Splunk SIEM/SOAR expertise.
• Deep understanding of SOC workflows, MITRE ATT&CK, cloud and network technologies.
• Proven ability to diagnose and resolve log source issues in fast‑paced environments.

Required skills

• Splunk SIEM, Splunk SOAR (Phantom), CRIBL, SPL (Search Processing Language).
• Python scripting.
• Integration experience with ServiceNow, FortiSOAR, Cortex XSOAR.
• Cloud certifications (AWS, Google Cloud, Azure) and security certifications (CISSP, GIAC, CCNA, CCNP).