SIEM Administrator / Engineer

Andersen is seeking a skilled SIEM Administrator / Engineer to join a project focused on enhancing a robust SIEM platform. You will play a critical role in supporting centralized security monitoring, threat detection, and cyber defense operations for international organizations within a complex multi-tenant environment.

Key responsibilities

• Administer, maintain, and upgrade the SIEM platform, ensuring optimal health, performance, and capacity.
• Onboard and normalize diverse log sources including network, endpoint, cloud, and identity data.
• Develop and tune detection rules, correlation searches, dashboards, and reports to enhance security posture.
• Collaborate with SOC analysts to reduce false positives and implement new security use cases.
• Build and maintain SOAR playbooks and integrations while managing documentation and access control.

Requirements

• 5+ years of experience in IT or cybersecurity, with at least 3 years dedicated to enterprise SIEM administration.
• Hands-on expertise with major platforms such as Microsoft Sentinel, Splunk ES, IBM QRadar, or Elastic Security.
• Proficiency in log source onboarding and normalization using Syslog, CEF, WEF, and API-based connectors.
• Strong ability to write detection content using query languages like KQL, SPL, or AQL.
• Solid understanding of the MITRE ATT&CK framework for mapping detection coverage.
• Upper-Intermediate level of English or higher.

What we offer

• Opportunities to work with global industry leaders across sectors like FinTech, Healthcare, and Telecom.
• Access to a comprehensive corporate training portal and professional development resources.
• Structured mentoring and adaptation systems to support your career growth.
• Certification compensation programs for professional qualifications.
• A collaborative environment with a strong focus on professional and financial advancement.