Security Engineer (SIEM & SOAR)

Your tasks

We are seeking a Security Engineer (SIEM & SOAR) to join our Cyber Security team. The successful candidate will be responsible for implementing, maintaining, and enhancing security monitoring and automation capabilities using Elastic SIEM and Tines SOAR.

• Administer, maintain, and optimize Elastic SIEM environments.
• Develop, tune, and maintain detection rules, alerts, dashboards, and use cases within Elastic.
• Design, build, and maintain security automation workflows and playbooks using Tines SOAR.
• Integrate security tools such as EDR, email security, vulnerability management, and threat intelligence platforms into Tines workflows.
• Investigate security alerts and incidents, perform root cause analysis, and recommend remediation actions.
• Support SIEM onboarding activities, including log source integration, parsing, normalization, and data validation.
• Create and maintain documentation for security monitoring, automation workflows, and operational procedures.
• Collaborate with customers and internal cyber security teams to deliver project and operational requirements.
• Perform troubleshooting and resolution of SIEM and SOAR platform issues.
• Support continuous improvement initiatives to enhance detection coverage and operational efficiency.

Requirements

This role is ideal for candidates with hands-on experience in security operations, detection engineering, threat monitoring, incident response, and security automation who are looking to deepen their expertise in modern Security Operations Centre (SOC) technologies.

Mandatory Requirements

• Minimum 2 years of experience in Cyber Security, SOC Operations, SIEM Engineering, or Security Automation.
• Hands-on experience with Elastic SIEM (mandatory).
• Hands-on experience with Tines SOAR (mandatory).
• Experience developing detection rules, correlation logic, dashboards, and threat monitoring use cases.
• Experience building and maintaining automation workflows and incident response playbooks.
• Knowledge of security operations, incident management, and cyber security best practices.
• Familiarity with Windows and Linux operating systems.
• Basic understanding of networking concepts including TCP/IP, DNS, VPN, and firewall technologies.
• Good troubleshooting and analytical skills.
• Strong communication and documentation skills.

Preferred Qualifications

• Experience with Python, PowerShell, or scripting for automation.
• Exposure to EDR, DLP, IAM/PAM, Vulnerability Management, or Threat Intelligence platforms.
• Familiarity with MITRE ATT&CK framework and threat hunting practices.
• Experience working in a SOC, MSSP, or cyber security consulting environment.
• Security certifications such as Security+, CEH, SSCP, Elastic Certified Analyst, or equivalent.