Lead Cyber Security Engineer – SIEM & Detection Engineering

About the role

This role architects and optimizes the SIEM platform, designs detection use cases across endpoint, network, identity, cloud, and application layers, and ensures reliable, cost-efficient log ingestion and normalization. A core responsibility is engineering and operating Cribl Stream and Cribl Edge to route, filter, enrich, and transform security telemetry at scale—improving SIEM visibility, data quality, performance, and cost management.

What you'll do

• Architect and optimize SIEM platforms (e.g., Microsoft Sentinel, Splunk), including ingestion pipelines, parsing/normalization, enrichment, and correlation logic
• Engineer and operate Cribl Stream and Cribl Edge for log routing, filtering, transformation, enrichment, data reduction, and destination fan-out (SIEM, data lake
• Design and maintain telemetry onboarding with schema mapping, collectors/agents, connectors, API integrations, replay, and edge collection for diverse sources (endpoint
• Develop advanced detections and analytics (rules, queries, correlations) aligned to MITRE ATT&CK, emerging TTPs, and threat intelligence
• Lead systematic alert tuning to reduce false positives and improve signal-to-noise, leveraging Cribl pipelines and SIEM analytics to standardize high-fidelity events

What you need

• SIEM
• Firewalls
• Splunk
• Root cause analysis

Good to have

• CISSP
• CISM
• CEH