siem engineer

<div></div><div><div><div><div><ul><div>2 - 3 Years</div>
<div></div><div>1 Opening</div>
 <div>Hyderabad</div></ul></div><div> 
<div><div>
</div></div></div></div><div></div><div><h3 class="jobSectionHeader">Role description</h3>
<div>Role Overview 
The SIEM Senior Engineer is responsible for hands-on engineering, enrichment, and monitoring of security s using Splunk. This role focuses on building high-quality detections, enriching s with meaningful context, and improving SOC analyst efficiency by reducing false positives and improving signal quality. The role works closely with SOC Analysts, SIEM Leads, and Security Engineering teams. 
Key Responsibilities 
Engineer, maintain, and tune Splunk-based SIEM s and correlation rules. 
Monitor security s to ensure accuracy, relevance, and operational readiness. 
Continuously tune s to improve signal-to-noise ratio and reduce false positives. 
Implement enrichment using identity, asset, vulnerability, and threat intelligence data. 
Ensure s contain actionable context such as user, asset, privilege, and business impact. 
Support Splunk log onboarding, data normalization, and CIM compliance. 
Optimize SPL searches, dashboards, and saved searches. 
Support L2/L3 troubleshooting for SIEM s and ingestion issues. 
Develop detection use cases aligned to the MITRE ATT&amp;CK framework. 
Maintain SOPs, runbooks, and SIEM documentation. 
Required Skills &amp; Experience 
3-5 years of experience in SIEM, SOC, or Security Engineering roles. 
Strong hands-on experience with Splunk
 
Proven experience in SIEM creation, tuning, and enrichment. 
Strong understanding of security telemetry across endpoint, network, cloud, and IAM. 
Proficiency in SPL (Search Processing Language). 
Understanding of SOC workflows and incident triage. 
Familiarity with the MITRE ATT&amp;CK framework. 
Preferred Qualifications 
Experience integrating Splunk with IAM, CMDB, vulnerability, and threat intelligence tools. 
Exposure to SOAR platforms and automated response workflows. 
Scripting experience using Python or PowerShell. 
Experience working in regulated environments such as healthcare or financial services. 
Relevant Splunk or security certifications.</div> 
<h3 class="jobSectionHeader">Skills</h3>
<div>siem,security s, tuning, enrichment,</div></div></div></div>
 <div><h3 class="jobSectionHeader">About UST</h3>
<div>UST is a global digital transformation solutions provider. For more than 20 years, UST has worked side by side with the world&rsquo;s best companies to make a real impact through transformation. Powered by technology, inspired by people and led by purpose, UST partners with their clients from design to operation. With deep domain expertise and a future-proof philosophy, UST embeds innovation and agility into their clients&rsquo; organizations. With over 30,000 employees in 30 countries, UST builds for boundless impact&mdash;touching billions of lives in the process.</div></div>

SIEM Enrichment & Monitoring

<div>
 
 
 The SOC Engineer, Sentinel, is a critical role responsible for delivering SIEM management services, particularly focusing on Sentinel, within the Security Operations Center (SOC). This role encompasses onboarding new log sources, enhancing and optimizing telemetry, ensuring system updates, resolving issues, and maintaining SIEM performance according to best practices. Reporting to the SOC Engineering &amp; Architecture Manager, the SOC Engineer, Sentinel, is a professional with a solid foundation in SOC operations.
 
 
 
 
 
 
 
 Responsibilities:
 
 
 <ul>
 <li>
 Sentinel SIEM management services within the SOC environment.
 </li>
 <li>
 Govern SOC critical log sources, ensuring their proper functionality and integration with Sentinel SIEM.
 </li>
 <li>
 Log source issues, coordinate with customers to diagnose and resolve them in a timely manner and optimize telemetry within the Sentinel environment to improve data collection, correlation, and reporting.
 </li>
 <li>
 The performance of the Sentinel SIEM according to established best practices.
 </li>
 <li>
 In continuous process improvements to increase SOC efficiency and effectiveness.
 </li>
 <li>
 Regular and accurate reports on Sentinel services and SOC operations to relevant stakeholders.
 </li>
 </ul>
 
 
 
 
 
 
 
 
 Skills:
 
 
 <ul>
 <li>
 Knowledge and hands-on experience with Sentinel SIEM and other related technologies such as MS Defender.
 </li>
 <li>
 Understanding of cloud and network technologies, essential for efficient log source onboarding.
 </li>
 <li>
 Technical capabilities in a complex, fast-paced SOC environment.
 </li>
 <li>
 To diagnose and troubleshoot log source issues related to cloud and network infrastructures.
 </li>
 <li>
 Understanding of SOC operations, cybersecurity principles, and best practices.
 </li>
 <li>
 Problem-solving skills and the ability to make decisions under pressure.
 </li>
 <li>
 To collaborate effectively with a variety of team members, including interfacing with customers to resolve issues.
 </li>
 <li>
 Proficiency in written and verbal communication
 </li>
 </ul>
 
 
 
 
 
 Certifications:
 
 
 
 
 
 
 
 Must have:
 
 
 <ul>
 <li>
 in SC-200
 </li>
 <li>
 in AZ 500
 </li>
 </ul>
 
 
 
 
 
 Optional:
 
 
 <ul>
 <li>
 Certifications like AWS Certified Solutions Architect, Google Professional Cloud Architect, or Microsoft Certified: Azure Solutions Architect Expert.
 </li>
 <li>
 Certifications such as CCNA or CCNP are advantageous.
 </li>
 </ul>
 
 
 
 
 
 Educational Experience:
 
 
 <ul>
 <li>
 Degree in computer science, Information Technology, Cybersecurity, or a related field.
 </li>
 <li>
 Minimum of 4-5 years of experience in SOC operations, with significant experience in Sentinel SIEM management.
 </li>
 <li>
 Experience in a technical role within a SOC or similar cybersecurity environment.
 </li>
 </ul>
 
 
</div>

SOC Engineer - Sentinel

Al Adyat consultancy

Role OverviewOwns end-to-end delivery of the Splunk Enterprise (SIEM) platform, covering architecture, design, onboarding, configuration, tuning, use case implementation, and structured handover into operations.Key Responsibilities&middot; Lead solution architecture and detailed design (HLD / LLD) for Splunk SIEM&middot; Build, configure, and manage Splunk platform components including indexers, search heads, forwarders, and apps&middot; Onboard log sources and data feeds in line with security logging standards&middot; Develop, tune, and optimize correlation searches, alerts, and detections&middot; Implement threat-based and use-case-driven monitoring aligned to MITRE ATT&amp;CK&middot; Validate data quality, parsing, normalization, and field extractions&middot; Integrate Splunk with upstream and downstream tools including EDR, SOAR, ticketing, and threat intelligence&middot; Produce operational documentation and conduct knowledge transfer to run teams&middot; Support stabilization and transition into BAU operationsSkills and Experience&middot; Strong hands-on experience with Splunk Enterprise SIEM&middot; Proven experience in SIEM architecture, engineering, log onboarding, and use-case development&middot; Strong understanding of security logging, detection engineering, and incident response&middot; Experience integrating SIEM with EDR, SOAR, and enterprise security tooling&middot; Experience producing technical design and operational handover documentationKey Deliverables&middot; SIEM solution architecture and design documentation&middot; Configured and optimized Splunk SIEM platform&middot; Implemented and tuned detection and monitoring use casesRunbooks, SOPs, and formal handover to operationsPay: QAR12,000.00 - QAR14,000.00 per monthEducation:<ul><li>Bachelor's (Required)</li></ul>Experience:<ul><li>Splunk Enterprise (SIEM) platform: 3 years (Required)</li><li>EDR, SOAR, and enterprise security tooling: 3 years (Required)</li></ul>Language:<ul><li>Arabic (Required)</li><li>English (Required)</li></ul>License/Certification:<ul><li>degree in computer science (Required)</li></ul>Location:<ul><li>Doha (Required)</li></ul>Work Location: In person

SIEM Specialist (Splunk)

Role OverviewOwns end-to-end delivery of threat intelligence onboarding and integration using Anomali, including architecture, data ingestion, enrichment, correlation, and integration with Splunk SIEM and Splunk SOAR to enhance detection, investigation, and automated response capabilities.Key Responsibilities&middot; Lead solution architecture and detailed design (HLD / LLD) for threat intelligence integration&middot; Deploy, configure, and optimize Anomali Threat Intelligence Platform&middot; Onboard threat intelligence feeds and manage lifecycle, scoring, and confidence tuning&middot; Integrate Anomali with Splunk SIEM for enrichment, correlation, and detection enhancement&middot; Integrate threat intelligence into Splunk SOAR playbooks for automated response&middot; Implement use cases aligned to SOC investigation and threat hunting workflows&middot; Validate data quality, mappings, and enrichment effectiveness&middot; Troubleshoot integration, data, and performance issues&middot; Produce operational documentation and conduct knowledge transfer to run teams&middot; Support stabilization and transition into BAU operationsSkills and Experience&middot; Strong hands-on experience with Anomali Threat Intelligence Platform&middot; Experience integrating threat intelligence with Splunk SIEM and Splunk SOAR&middot; Strong understanding of threat intelligence lifecycle, IOC management, and enrichment&middot; Knowledge of SOC operations, threat detection, and incident response&middot; Experience producing technical design and operational handover documentationKey Deliverables&middot; Threat intelligence architecture and integration design documentation&middot; Configured Anomali TIP integrated with Splunk SIEM and SOAR&middot; Enrichment and correlation use cases implemented&middot; Runbooks, SOPs, and formal handover to operationsPay: QAR12,000.00 - QAR14,000.00 per monthEducation:<ul><li>Bachelor's (Required)</li></ul>Experience:<ul><li>Anomali Threat Intelligence Platform: 3 years (Required)</li><li>Splunk SIEM and Splunk SOAR: 3 years (Required)</li></ul>Language:<ul><li>Arabic (Required)</li><li>English (Required)</li></ul>License/Certification:<ul><li>degree in computer science (Required)</li></ul>Location:<ul><li>Doha (Required)</li></ul>Work Location: In person

Threat Intelligence Specialist (Anomali / Splunk)

Nets-international Communication

Cisco Umbrella Security EngineerJob SummaryWe are seeking a skilled Cisco Umbrella Security Engineer responsible for implementing, managing, and supporting cloud-based security solutions using Cisco Umbrella. The role involves protecting enterprise networks from cyber threats through DNS-layer security, secure web gateway, and cloud-delivered firewall capabilities. The engineer will work closely with network, cloud, and security teams to ensure secure internet access and threat prevention.Key Responsibilities<ul><li>Deploy, configure, and manage Cisco Umbrella security solutions for enterprise environments.</li><li>Monitor DNS-layer security events, policy violations, and threat intelligence alerts using the Umbrella dashboard.</li><li>Configure and manage web filtering, DNS security policies, and access controls.</li><li>Integrate Cisco Umbrella with firewalls, SIEM tools, and identity platforms.</li><li>Investigate and respond to security incidents and internet-based threats.</li><li>Troubleshoot issues related to roaming clients, DNS security, and secure web gateway services.</li><li>Conduct security policy reviews and optimization for improved threat protection.</li><li>Collaborate with IT and cybersecurity teams to ensure secure network architecture.</li><li>Generate security reports and provide recommendations to management.</li><li>Document security configurations, incident reports, and standard operating procedures.</li></ul>Required Skills<ul><li>Strong knowledge of networking protocols (TCP/IP, DNS, DHCP, VPN).</li><li>Hands-on experience with Cisco Umbrella or Secure Internet Gateway (SIG).</li><li>Experience with firewalls, IDS/IPS, and SIEM tools.</li><li>Understanding of Zero Trust, Secure Web Gateway (SWG), and cloud security.</li><li>Experience integrating Umbrella with Active Directory, endpoint security, or cloud platforms.</li><li>Strong troubleshooting and incident response skills.</li></ul>Qualifications<ul><li>Bachelor&rsquo;s degree in Computer Science, Information Security, or IT.</li><li>3&ndash;7 years of experience in cybersecurity or network security roles.</li><li>Hands-on experience with Cisco security technologies.</li></ul>Preferred Certifications<ul><li>CCNA Security</li><li>CCNP Security</li><li>Cisco Umbrella / Secure Access certifications</li></ul>Tools &amp; Technologies<ul><li>Cisco Umbrella</li><li>Cisco SecureX</li><li>Cisco ASA / Cisco Secure Firewall</li><li>SIEM (Splunk, QRadar)</li><li>DNS security tools</li><li>VPN &amp; Zero Trust solutions</li></ul>Job Type: Full-timePay: RO34,000.000 - RO45,000.000 per yearWork Location: In person

Cisco Umbrella Security

DeepSource Technologies

<div>We are seeking an experienced Senior API Security Engineer to join our team on-site. The ideal candidate will have strong expertise in API gateway security, network security solutions, and SIEM integration, with a proven ability to protect enterprise environments against evolving cyber threats.
Key Responsibilities<ul><li>
Design, implement, and manage API security solutions across enterprise environments
</li><li>Configure and maintain API Gateways (e.g., F5, Kong, IBM DataPower)
</li><li>Implement and manage IDS/IPS systems for threat detection and prevention
</li><li>Integrate security solutions with SIEM platforms for monitoring and incident response
</li><li>Develop and enforce API security policies, including rate limiting, authentication, and threat protection
</li><li>Secure APIs by identifying and blocking malicious patterns and automated bot attacks
</li><li>Perform security assessments, vulnerability analysis, and risk mitigation
</li><li>Collaborate with cross-functional teams to ensure secure application delivery</li></ul> 

Requirements 
Minimum 5+ years of experience in API security and network security
Hands-on experience with:
<ul><li>F5 / Kong / IBM DataPower API Gateways
</li><li>IDS/IPS solutions
</li><li>SIEM integration
</li></ul>Strong understanding of:
<ul><li>API security best practices
</li><li>Network security architecture
</li><li>Threat detection and mitigation techniques
</li></ul>Experience in securing APIs against common attack vectors (OWASP, bot attacks, etc.)
Relevant security certifications are mandatory:
<ul><li>CISSP
</li><li>GICSP
</li><li>Or equivalent</li></ul></div>

Senior API Security Engineer - Riyadh, KSA

STC Bahrain

stc Bahrain provides telecommunications and digital services across Bahrain.At stc Bahrain, cybersecurity roles usually sit within Business Products &amp; Solutions / ICT / SOC (Security Operations / Enterprise Security) teams.Core Responsibilities:Depending on level (SOC Analyst, Engineer, or Specialist), typical duties include:1. Threat Monitoring &amp; DetectionMonitor security alerts from SIEM tools and SOC systemsDetect suspicious network activity and cyber threatsAnalyze logs from servers, endpoints, and cloud systems2. Incident ResponseInvestigate cyber incidents (malware, phishing, breaches)Contain and escalate security threatsSupport recovery and forensic analysis3. Security OperationsMaintain firewalls, IDS/IPS, endpoint protection toolsApply security patches and updatesEnsure network and cloud security compliance4. Risk &amp; ComplianceSupport cybersecurity audits and risk assessmentsEnsure alignment with ISO 27001 and telecom security standardsDocument vulnerabilities and mitigation plans5. Enterprise &amp; Cloud Security (advanced roles)Secure cloud platforms and applicationsManage identity/access control systemsSupport Zero Trust security frameworksstc also operates a large SOC and AI-driven cybersecurity ecosystem protecting networks, cloud, and enterprise systemsSkills &amp; Requirements:Bachelor&rsquo;s in IT / Computer Science / CybersecurityCertifications (preferred):Security+ / CEH / CISSP / CCNA SecurityKnowledge of:SIEM tools (Splunk, QRadar)Firewalls, endpoint security, IDS/IPSStrong analytical and incident handling skillsUnderstanding of telecom or enterprise networks is a plusPay: From RO1,000.000 per monthWork Location: In person

Cybersecurity (stc Bahrain)

Search 3950+ Siem engineer jobs near you this May. New roles added regularly across leading industries. Apply today.