Role
Lead the design, deployment and tuning of enterprise-grade SIEM platforms (e.g. Splunk, Azure Sentinel etc.)
Collaborate with stakeholders to define logging requirements, use cases, detection rules and dashboards
Oversee integration of data sources from cloud, on-prem, endpoint, network and application layers
Create and maintain detection rules, correlation logic and alerts tailored to specific threat scenarios
Provide technical leadership and mentorship to team members
Work closely with SOC teams to align SIEM capabilities with business objectives
Conduct SIEM health checks, performance tuning and capacity planning
Skills
Expertise in SIEM design, deployment and optimisation
Hands-on expertise with one or more major SIEM platforms (e.g. Splunk, Sentinel etc.)
Deep understanding of log ingestion, parsing, normalisation and enrichment
Strong grasp of MITRE ATT&CK framework, threat detection and alert logic
Solid scripting/automation skills (e.g., Python, PowerShell, Bash)
Experience with cloud logging and monitoring (AWS CloudTrail, Azure Monitor, GCP etc.)
Experience with threat modelling, cloud security or Identity and Access Management is desirable