Security Engineer III, SIEM Engineer (Secret Clearance)

Deloitte is a leading firm in cybersecurity, seeking a SIEM Engineer to enhance security monitoring and incident analysis. The role focuses on optimizing SIEM content and improving detection capabilities to strengthen cyber defense for clients.

Responsibilities:

• Configure, maintain, and optimize SIEM content including correlation rules, alerts, dashboards, and reports
• Analyze security events and log data to identify suspicious activity, support investigations, and improve detection coverage
• Integrate and normalize log sources from endpoint, network, cloud, identity, and security platforms
• Partners with cybersecurity teams to support use case development, threat detection, incident triage, and response activities
• Document detection logic, operational procedures, and monitoring requirements to support consistent service delivery

Requirements:

• Bachelor's degree in computer science, Cybersecurity, Information Technology, Engineering, or a degree in related technical field
• Active Secret Clearance
• 3+ years of experience in cybersecurity, security operations, or SIEM engineering
• 3+ years of experience with at least one of the following: Splunk, Palo Alto XSIAM, or Crowdstrike NG SIEM
• 2+ years' experience in the following areas: Creating, tuning, and maintaining correlation searches, alerts, dashboards, and reports in a Security Information and Event Management platform
• 2+ years' experience in reviewing and analyzing logs from endpoint, network, cloud, identity, and application sources
• Security certification such as Splunk certification, Palo Alto Networks certification, or CrowdStrike certification is required
• Ability to travel up to 20%, on average, based on the work you do and the clients and industries/sectors you serve
• Must be willing to work at client onsite or Deloitte office for up to 5 days a week
• Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future
• 2+ years' experience supporting enterprise monitoring in a Security Operations Center
• Experience onboarding and normalizing log sources in a Security Information and Event Management platform
• Experience mapping detections to MITRE ATT&CK techniques
• Experience with cloud security monitoring in Amazon Web Services, Microsoft Azure, or Google Cloud Platform
• Hands-on experience with scripting or query languages used for detection and log analysis
• Security certification such as CompTIA Security+, or GIAC certification