Security Engineers - SIEM & SOAR (CL8)

Key Responsibilities

SIEM Engineering & Management
• Design, implement, and optimize SIEM solutions (e.g., Splunk, Microsoft Sentinel, Google SecOps, QRadar, Elastic).
• Develop and maintain correlation rules, dashboards, and reports to identify threats and anomalies.
• Integrate diverse data sources (network, endpoints, cloud, applications) into the SIEM platform.
• Enhance data ingestion, parsing, and normalization to improve detection quality and reduce noise.

SOAR & Automation
• Implement and manage SOAR platforms (e.g., Cortex XSOAR, Splunk SOAR, IBM Resilient).
• Develop automated playbooks for incident response, alert triage, and threat intelligence enrichment.
• Collaborate with SOC analysts to streamline workflows and improve response efficiency.
• Maintain integrations with ticketing systems, threat intel feeds, and security tools.

Security Engineering & Operations Support
• Support incident response by delivering actionable alerts and automation-driven insights.
• Conduct root cause analysis of recurring threats and implement engineering solutions.
• Partner with audit and compliance teams to align security controls with regulatory standards.
• Provide training and documentation for SOC and IT teams on SIEM/SOAR platforms.

Qualifications

Education & Experience
• Bachelor’s degree in Cybersecurity, IT, Computer Science, or related field.
• 3–8 years of cybersecurity experience, with strong hands-on experience in SIEM and/or SOAR engineering.
• Experience in a SOC environment is highly preferred.

Core Technical Skills
• Proven experience with at least one SIEM platform (Splunk, Sentinel, QRadar, ArcSight, Google SecOps).
• Hands-on experience developing SOAR playbooks and automation workflows.
• Scripting skills (Python, PowerShell, or Bash) for automation and integrations.
• Knowledge of frameworks such as MITRE ATT&CK, NIST, or CIS Controls.
• Familiarity with EDR/XDR, firewalls, IDS/IPS, and cloud security (AWS, Azure, or GCP).

Work Setup
• Willing to work on a shifting schedule.
• Open to hybrid or on-site work (Cyberpark, Cubao).