Lead SOC Engineer (SIEM)

About the role

The Lead SOC Engineer (SIEM) is a senior technical leader within the Security Operations Center. Reporting to the Senior SOC Engineering & Architecture Manager, the role drives SIEM architecture, day‑to‑day operations, and pre‑sales support for multiple customers.

Key responsibilities

• Lead technical operations and management of SIEM tools such as Splunk, Microsoft Sentinel, LogRhythm, QRadar and FortiSIEM.
• Oversee the log‑collection layer, focusing on CRIBL and ensure continuous health checks.
• Manage SIEM license forecasting, usage tracking and coordinate renewals with sales.
• Optimize telemetry for accurate data collection, correlation and reporting.
• Develop and enforce logging standards across all customer environments.
• Mentor senior and junior SOC engineers, providing guidance on issue resolution.
• Participate in pre‑sales activities, delivering technical expertise and license estimations.
• Collaborate on SIEM architecture strategy and drive continuous process improvements.
• Produce regular reports on SIEM services, SOC operations and license management.

Required profile

• More than ten years of hands‑on experience in SIEM operations and SOC environments.
• Proven technical leadership in fast‑paced, complex settings.
• Demonstrated pre‑sales experience, especially in estimating SIEM licenses.
• Strong understanding of cybersecurity principles and SOC best practices.

Required skills

• Splunk
• Microsoft Sentinel
• LogRhythm
• FortiSIEM
• QRadar
• CRIBL