Lead Cybersecurity Engineer

About the role

The SIEM Lead Engineer is responsible for leading the design, development, and optimization of SIEM alerting, enrichment, and monitoring capabilities using Splunk. This role focuses on improving alert fidelity, contextual enrichment, detection engineering, and overall SOC effectiveness. The role acts as a technical lead and escalation point, working closely with SOC Analysts, Threat Detection, Security Engineering, and platform teams.

What you'll do

• Lead engineering and optimization of Splunk-based SIEM alerting and monitoring
• Design, develop, and tune correlation rules and detections to reduce false positives
• Own alert lifecycle management including creation, tuning, validation, and retirement
• Design and implement alert enrichment using IAM, CMDB, vulnerability, and threat intelligence sources
• Ensure alerts are enriched with user, asset, privilege, and business context

What you need

• SIEM
• Splunk
• IAM
• Compliance
• SOP writing

Good to have

• Python
• PowerShell