Security Engineer (SIEM & SOAR)

We are seeking a Security Engineer (SIEM & SOAR) to join our Cyber Security team. The successful candidate will be responsible for implementing, maintaining, and enhancing security monitoring and automation capabilities using Elastic SIEM and Tines SOAR.

This role is ideal for candidates with hands-on experience in security operations, detection engineering, threat monitoring, incident response, and security automation who are looking to deepen their expertise in modern Security Operations Centre (SOC) technologies.

Key Responsibilities

• Administer, maintain, and optimize Elastic SIEM environments.
• Develop, tune, and maintain detection rules, alerts, dashboards, and use cases within Elastic.
• Design, build, and maintain security automation workflows and playbooks using Tines SOAR.
• Integrate security tools such as EDR, email security, vulnerability management, and threat intelligence platforms into Tines workflows.
• Investigate security alerts and incidents, perform root cause analysis, and recommend remediation actions.
• Support SIEM onboarding activities, including log source integration, parsing, normalization, and data validation.
• Create and maintain documentation for security monitoring, automation workflows, and operational procedures.
• Collaborate with customers and internal cyber security teams to deliver project and operational requirements.
• Perform troubleshooting and resolution of SIEM and SOAR platform issues.
• Support continuous improvement initiatives to enhance detection coverage and operational efficiency.

Mandatory Requirements

• Minimum 2 years of experience in Cyber Security, SOC Operations, SIEM Engineering, or Security Automation.
• Hands-on experience with Elastic SIEM (mandatory).
• Hands-on experience with Tines SOAR (mandatory).
• Experience developing detection rules, correlation logic, dashboards, and threat monitoring use cases.
• Experience building and maintaining automation workflows and incident response playbooks.
• Knowledge of security operations, incident management, and cyber security best practices.
• Familiarity with Windows and Linux operating systems.
• Basic understanding of networking concepts including TCP/IP, DNS, VPN, and firewall technologies.
• Good troubleshooting and analytical skills.
• Strong communication and documentation skills.

Preferred Qualifications

• Experience with Python, PowerShell, or scripting for automation.
• Exposure to EDR, DLP, IAM/PAM, Vulnerability Management, or Threat Intelligence platforms.
• Familiarity with MITRE ATT&CK framework and threat hunting practices.
• Experience working in a SOC, MSSP, or cyber security consulting environment.
• Security certifications such as Security+, CEH, SSCP, Elastic Certified Analyst, or equivalent.