Senior Security Engineer

Role Overview

We are seeking a Senior Security Engineer to support the Engineering Qualification operating model, with responsibility for the technical assessment, design, onboarding, validation, and optimization of security telemetry, cloud integrations, and SIEM use cases. The role will work closely with Security Engineering, Threat Monitoring, Technology & Infrastructure teams, platform owners, and other stakeholders to ensure integrations are secure, scalable, supportable, and cost-effective. The engineer will also provide technical leadership and mentor junior team members.

Key Responsibilities

• Lead technical qualification of new SIEM onboarding requests, integrations, and security telemetry requirements.
• Assess solution architecture, security controls, authentication methods, connectivity, network dependencies, and access requirements.
• Design and review log onboarding patterns, telemetry pipelines, and SIEM integration architectures.
• Define and implement Data Collection Rules (DCRs), parsers, transformations, normalization, and schema mappings.
• Support adoption of Advanced Security Information Model (ASIM) normalization standards where applicable.
• Estimate telemetry volumes and assess ingestion, storage, retention, and operational cost implications.
• Design scalable and reusable ingestion patterns across cloud, on-premises, Linux, container, and third-party platforms.
• Develop and review KQL queries, analytics rules, detections, hunting queries, and SIEM use cases.
• Troubleshoot complex issues related to collection, ingestion, parsing, connectivity, authentication, and data quality.
• Validate integrations through functional, security, performance, and operational testing.
• Develop reusable engineering standards, onboarding templates, reference architectures, automation, and technical accelerators.
• Collaborate with Security Engineering, Threat Monitoring, T&I; teams, application teams, and platform owners.
• Review technical designs for alignment with security, architecture, and operational standards.
• Drive continuous improvement of telemetry quality, coverage, performance, and cost efficiency.
• Mentor junior engineers and provide technical oversight during onboarding and troubleshooting activities.
• Maintain high-quality engineering documentation, technical decision records, runbooks, and implementation standards.

Required Experience & Skills

• 8+ years of experience in Security Engineering, Security Operations Engineering, SIEM Engineering, Cloud Security, or a related discipline.
• Advanced Microsoft Azure experience, including Entra ID, Azure Networking, Log Analytics, Azure Monitor, Key Vault, and RBAC.
• Advanced experience with Microsoft Sentinel preferred; strong experience with another enterprise SIEM may be considered.
• Advanced knowledge of Kusto Query Language (KQL) and detection engineering.
• Strong hands-on knowledge of log ingestion, parsing, normalization, enrichment, and schema design.
• Experience with Azure Monitor Agent (AMA), Syslog, Logstash, Fluent Bit, Beats, or equivalent collection technologies.
• Experience designing and maintaining Data Collection Rules (DCRs) and telemetry pipelines.
• Strong understanding of security architecture, identity, authentication, network security, and secure integration patterns.
• Experience with telemetry volume estimation, retention planning, and SIEM cost optimization.
• Good working knowledge of Linux and container platforms.
• Experience with Git-based workflows and CI/CD practices.
• Demonstrated ability to troubleshoot complex integration and telemetry issues.
• Experience mentoring or technically guiding junior engineers

Desirable Experience

Experience with Splunk, IBM QRadar, Elastic Security, or other enterprise SIEM platforms.

Experience with infrastructure-as-code and automation technologies such as Terraform, Bicep, Azure DevOps, or GitHub Actions.

Experience developing detections mapped to MITRE ATT&CK; or equivalent frameworks.

Knowledge of cloud-native security monitoring and multi-cloud telemetry architectures.

Relevant Microsoft, Azure, SIEM, or cybersecurity certifications.