مهندس أنظمة إدارة المعلومات والأحداث الأمنية (SIEM)

The SIEM Engineer will manage and optimize enterprise SIEM platforms, supporting security monitoring, log management, threat detection, and incident response across on-premises and cloud environments. The role requires hands-on experience with SIEM deployment, security tool integrations, log onboarding, detection rules, and cloud security monitoring, along with strong troubleshooting and analytical skills.

Responsibilities

• Designing, reviewing, implementing, testing, maintaining, and troubleshooting SIEM deployments and infrastructures.
• Responsible for managing arrangements of dependencies and pre-requisites for SIEM projects e.g., connectivity, storage, licenses, and other equipment).
• Responsible for implementing changes to the SIEM infrastructure (including patches, updates, and upgrades) and performing SIEM Health Checks; and for creating technically relevant detailed reports to track solution effectiveness and performance.
• Manage SIEM Appliance or Virtual Appliance (including OS and SIEM software).
• Configure backups, verify custom reports, manage log source groups, and validate log sources.
• Manage SIEM user accounts (create, delete, modify, etc.).
• Add /Remove log sources. Troubleshoot issues with log sources or systems with system owners and vendors, and report system defects and product enhancement / feature requests with vendors as needed.
• Be responsible for development of integrations, connectors, and parsers for new event sources
• Implementing security monitoring rules in a SIEM tooling, according to the business needs
• Assist with fully optimizing the SIEM system capabilities and identifying opportunities for automation to improve SIEM effectiveness and efficiency.
• Create rules and reports for compliance and audit requirements and create and manage Watch Lists for current threats.
• Create engineering and security documentation for internal and external needs including high level and low-level design of SIEM infrastructure, as-built documentation and documentation for custom connectors/parsers and integrations.
• Assist with designing and documenting work processes within the SOC.
• Responsible for mentoring and training of Junior SIEM Engineers.
• Perform other duties as assigned.

Qualifications

Experience:

• Minimum 5 years of experience in Security Engineering, including at least 3 years of hands-on experience managing SIEM solutions.

Educational Qualifications:

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or a related field.

Required Skills:

• Proven experience in designing and implementing SIEM solutions.
• Hands-on experience integrating security tools such as AV, AAA, Firewalls, DLP, and IDS/IPS with SIEM platforms.
• Experience implementing SIEM monitoring across cloud environments, including:
  • AWS: CloudTrail, GuardDuty, VPC Flow Logs
  • Azure: Activity Logs, Entra ID Sign-in Logs, Microsoft Defender for Cloud
  • GCP: Cloud Audit Logs, VPC Flow Logs
  • OCI: Audit Logs, Cloud Guard
• Strong hands-on experience with SIEM technologies such as Splunk, Microsoft Sentinel, and Google SecOps.
• Good understanding of Information Security regulations, frameworks, and requirements, with the ability to map security needs to appropriate SIEM solutions.
• Solid understanding of Information Security and Networking.
• Experience with scripting and query languages for SIEM data onboarding, such as Python, Regex, SPL, and KQL.
• Strong analytical, troubleshooting, and problem-solving skills, with a focus on identifying and addressing root causes.
• Excellent time management, organizational, and prioritization skills, with the ability to manage multiple stakeholders and competing priorities.
• Strong written and verbal communication skills, with the ability to explain complex technical concepts to non-technical stakeholders.
• Ability to work on-call, including nights and weekends, when required.
• Ability to work effectively in a high-demand, customer-focused environment and deliver quality results within agreed timelines.

Desirable:

• Regional experience and familiarity with the Middle East.
• Experience working within an MSSP or MDR environment.
• Experience deploying and administering multiple SIEM technologies.
• Relevant certifications in Splunk, Microsoft Sentinel, Google SecOps, or other SIEM technologies.