Senior SOC Engineer - SIEM (Splunk)

About the role

The Senior SOC Engineer manages SIEM services within the Security Operations Center, with a primary focus on Splunk SIEM and Splunk UEBA. The role covers onboarding new log sources, optimizing telemetry, keeping systems updated, troubleshooting issues and maintaining SIEM performance, while supporting SIEM architecture improvements and deployments aligned with business needs.

Key responsibilities

• Manage Splunk SIEM services and implement scalable Splunk-based SIEM solutions following best practices
• Define data ingestion strategies, parsing logic and correlation rules, and onboard new log sources
• Maintain critical log sources and troubleshoot issues promptly
• Optimize telemetry for better data collection, correlation and reporting
• Collaborate with SOC and threat intelligence teams to build detection use cases, and create dashboards, alerts and reports
• Perform system updates, version upgrades and feature rollouts, and ensure CIM compliance, field extractions and data normalization
• Evaluate and deploy Splunk apps and add-ons, and document workflows, configurations and procedures
• Work cross-functionally with IT, DevOps and security teams and support continuous process improvements

Required profile

• Minimum 3-5 years of experience in SOC operations, with significant experience in Splunk SIEM management
• Prior technical role in a SOC or similar cybersecurity environment
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity or a related field
• Proven ability to work independently, solve problems under pressure and communicate clearly in writing and verbally

Required skills

• Splunk Certified Administrator and mastery of SPL
• Scripting in Python, Bash and PowerShell
• Certifications such as CISSP or GIAC preferred; cloud architect certifications (AWS, Google, Azure) also mentioned
• Understanding of SOC workflows, MITRE ATT&CK and threat detection methodologies