Cyber Security Engineer - SIEM Consultant

About the role

This role is a Professional Services Consultant focused on SIEM (Cortex XSIAM) for cybersecurity clients. You will work with the technical lead to build log ingestion strategies, act as a subject matter expert in SIEM and correlation, and advise customers on how to optimise their security posture.

Key responsibilities

• Collaborate with the technical lead to devise a comprehensive log ingestion strategy
• Fine-tune log sources and correlation rules to improve system efficiency
• Serve as subject matter expert in SIEM, correlation and log source ingestion
• Act as a trusted advisor to customers, giving consultative guidance on optimising Cortex XSIAM usage
• Assess customer needs and recommend tailored security strategies
• Identify opportunities to improve analyst alert handling through automation
• Work with internal and external teams to drive product adoption
• Produce technical documentation on the SIEM aspects of each engagement
• Occasionally travel to customer meetings and workshops (up to 10% of the time)

Required profile

• 6+ years of hands-on experience deploying and integrating SIEM solutions in enterprise environments
• 4 years of experience with SOC tooling and processes
• Proven experience delivering consultative cybersecurity services to customers in SIEM and SOC
• Bachelor's degree or equivalent military experience or industry-recognised qualifications (e.g. CISSP, GIAC, SIEM vendor qualification) is a plus

Required skills

• Event collection, log management, event management, compliance automation and identity monitoring with SIEM platforms
• Designing correlation and detection rules for effective alerting
• Familiarity with Splunk and IBM QRadar
• Strong expertise in regular expressions
• Reading logs and finding relevant third-party documentation
• Generating SIEM status reports (logging source count, collection rate, performance indicators)
• Creating technical design documentation
• Knowledge of security analysis and response across endpoint, network and cloud environments is a plus