SIEM Engineer

# W2 Requirement

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline (4 years experience in lieu of degree)
• 5+ years experience relevant IT/cybersecurity experience.
• Ability to obtain and maintain a public trust requiring U.S. Citizenship or .
• 3+ years of hands-on SIEM administration experience supporting enterprise or similarly complex environments.
• Hands-on experience with Splunk Enterprise, including SPL, data ingestion, forwarders, indexes, searches, dashboards, alerts, and platform troubleshooting.
• Experience onboarding and troubleshooting enterprise log sources and understanding telemetry flow from source systems through collection, ingestion, indexing, and search.
• Working knowledge of SQL and experience querying data for analysis, troubleshooting, validation, or reporting.
• Experience with or working knowledge of Elastic, Elasticsearch, Kibana, or comparable search and analytics technologies, with the ability to rapidly develop deeper Elastic expertise.
• Understanding of enterprise logging concepts, including collection, parsing, normalization, enrichment, indexing, retention, and data quality.
• Strong Linux command-line skills and working knowledge of Windows/Linux systems, networking, and common protocols such as TCP/IP, DNS, HTTP/HTTPS, TLS, and syslog.
• Familiarity with enterprise cybersecurity technologies such as EDR, firewalls, IDS/IPS, identity systems, and vulnerability management platforms.
• Demonstrated ability to independently troubleshoot technical problems, analyze unfamiliar data, test assumptions, identify root causes, and develop practical solutions.
• Strong technical curiosity, ownership, accountability, and ability to learn new technologies, platforms, and query languages.
• Strong written and verbal communication skills with the ability to document technical processes and collaborate effectively across teams.