Security Siem

Security Siem Engineer Jobs

3 jobs found

Today

Senior Security Engineer- Security Operations

GE Appliances Louisville, KY

Louisville, KY

Today

Full time Senior Cloud Platforms Cybersecurity Operations

Apply Now

Job Description

GE Appliances is hiring a Senior Security Engineer to lead Security Operations detection and response engineering for enterprise IT and manufacturing environments.

Responsibilities

Act as the senior technical lead and subject-matter expert for security operations, owning detection and response platform architecture, configuration, and operational health; set technical standards used by the MSSP.
Design, build, test, and maintain detection content including correlation rules, behavioral analytics, and IOC/BIOC rules mapped to MITRE ATT&CK; manage the full detection lifecycle using detection-as-code practices (version control, testing, peer review, documentation).
Own telemetry coverage by identifying visibility gaps and onboarding, parsing, and normalizing log sources across endpoints, identity, Microsoft 365, cloud, network, email, DLP, and OT; monitor ingestion health and manage data volume and retention cost.
Engineer security automation and orchestration (SOAR) playbooks and integrations that enrich alerts, automate containment, and connect security tooling with IT service management and collaboration platforms to reduce manual effort and MSSP handling time.
Provide technical oversight of MSSP output in partnership with the Information Security leader owning the MSSP commercial relationship, including:
- Review triage and investigation quality, escalation accuracy, and run-book adherence.
- Drive false-positive reduction and tuning.
- Update MSSP run books and playbooks as detections and the environment change.
Serve as Tier 3 escalation for complex or high-severity incidents escalated by the MSSP; perform hands-on investigation, endpoint and log analysis, scoping, and containment; coordinate with the external incident response retainer when engaged.
Lead hypothesis-driven threat hunting informed by threat intelligence and threats targeting manufacturing; convert hunt outcomes into durable detections and hardening recommendations.
Operationalize threat intelligence by translating advisories, vulnerability disclosures, and adversary reporting into detections, hunts, and blocking actions; track relevant threat actors for GE Appliances.
Validate detection and response effectiveness using purple-team exercises, adversary emulation, and breach-and-attack simulation; measure coverage against MITRE ATT&CK and confirm MSSP detection and response.
Maintain EDR/XDR platform health across endpoint and server estate, including agent coverage, prevention and exploit-protection policies, exclusions governance, and response actions.
Strengthen vulnerability operations run by the MSSP: scan coverage (including authenticated scanning), risk-based prioritization using exploitability and threat intelligence (e.g., CISA KEV, EPSS), correlate vulnerabilities with active threat activity, and automate remediation workflows.
Partner with Cloud, Network, and Identity security engineers to integrate cloud security posture (CNAPP), network, and identity signals into detection and response, including identity threat detection for account takeover, MFA fatigue, and AiTM phishing.
Partner with OT Security to extend monitoring and detection into manufacturing environments safely for production and consistent with ISA/IEC 62443 and NIST SP 800-82.
Author and maintain incident response playbooks and technical run books; lead the technical portion of post-incident reviews and drive corrective actions to closure.
Define, automate, and report operational metrics and KPIs (e.g., MTTD, MTTR, ATT&CK detection coverage, false-positive rate, log source health, MSSP escalation quality) to the CISO and Information Security leadership.
Contribute to the security operations roadmap by evaluating emerging capabilities (including AI-assisted triage and agentic SOC automation) and supporting platform evaluations, proofs of concept, and TCO analyses.
Provide technical evidence for logging, monitoring, and incident response controls in SOX, C-SOX, PCI-DSS, and other audits; drive remediation of related findings.
Mentor engineers and transfer knowledge to MSSP analysts on the GE Appliances environment, detections, and response procedures.

Requirements

Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or related technical field, or equivalent practical experience.
6–10 years progressive experience in IT or information security, including 4+ years hands-on experience in security operations, detection engineering, or incident response in a large enterprise environment.
Deep hands-on experience engineering and administering SIEM/SOAR and EDR/XDR platforms (e.g., Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, CrowdStrike), including writing detection rules/queries (e.g., XQL, SPL, KQL).
Proven experience building detection content mapped to MITRE ATT&CK and tuning it for fidelity at enterprise scale.
Experience building SOAR playbooks and integrations; proficiency in Python and/or PowerShell; working with REST APIs and JSON.
Hands-on incident response experience with significant enterprise incidents such as ransomware, BEC, and account takeover, including endpoint, log, and network analysis.
Experience in a technical oversight role working with an MSSP/MDR, including tuning, escalation quality review, and run-book development.
Strong understanding of log sources and telemetry across Windows, Linux, network, cloud (AWS, Azure, and/or GCP), Microsoft 365, and identity providers.
Working knowledge of MITRE ATT&CK, NIST SP 800-61, NIST CSF, and CIS Controls.
Excellent verbal and written communication skills with the ability to communicate with technical and executive audiences.

Technologies

Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, CrowdStrike
XQL, SPL, KQL
Python, PowerShell, REST APIs, JSON
MITRE ATT&CK, SOAR, SIEM, EDR, XDR
Microsoft 365, CNAPP
CISA KEV, EPSS
ISA/IEC 62443, NIST SP 800-82, NIST SP 800-61, NIST CSF, CIS Controls
SOX, C-SOX, PCI-DSS
Detection-as-code, Git, Sigma, Atomic Red Team, MITRE Caldera

Preferred qualifications

Certifications: GIAC (GCIH, GCIA, GCDA, GCFA, GCTI), Palo Alto Networks Cortex certifications, CISSP, or similar.
Experience with detection-as-code practices, Git, CI/CD pipelines, and vendor-neutral rule formats such as Sigma.
Experience with threat hunting, purple teaming, and adversary emulation tools (Atomic Red Team, MITRE Caldera, breach-and-attack simulation platforms).
Familiarity with OT/ICS monitoring frameworks such as ISA/IEC 62443 or NIST SP 800-82.
Experience integrating cloud security (CNAPP/CSPM) and identity telemetry into detection and response.
Experience applying AI and large language models to security operations; familiarity with AI security frameworks such as MITRE ATLAS and the OWASP Top 10 for LLM Applications.
Experience in manufacturing, critical infrastructure, or global multinational organizations.

Working conditions

Normal office environment.
Occasional weekend and/or evening work; after-hours escalation for major security incidents and participation in an on-call rotation.

Location

Louisville, KY (onsite), USA

View full job page →

3d ago

Cyber Security Engineer

Trystar Inc Burnsville, MN

Burnsville, MN

3d ago

$130k - $160k/yr Full time Azure Azure Ad / Entra Id Cloud

Apply Now

Job Description

Trystar Inc is hiring a Cyber Security Engineer in Burnsville, MN (onsite). In this role, you will lead the design, implementation, monitoring, and continuous improvement of the organization’s cybersecurity program. The position offers deep technical ownership across threat detection, incident response, vulnerability management, identity security, security operations, and cybersecurity architecture, supported by a culture built on safety, integrity, customer focus, teamwork, and continuous improvement.

What you’ll do

Lead cybersecurity incident detection, investigation, containment, remediation, and recovery activities.
Act as the primary technical resource during security incidents, including development and maintenance of incident response playbooks and procedures.
Partner with internal teams, external partners, cyber insurance providers, and forensic teams during investigations.
Perform threat hunting and root cause analysis, and drive continuous improvements to security monitoring and alerting.
Own and enhance identity security controls across Microsoft Entra ID and Active Directory, including Conditional Access, MFA, PIM, and FIDO2 passwordless authentication.
Secure endpoint environments using Microsoft Defender and Intune, and establish identity governance and privileged access standards.
Collaborate with Digital & IT Teams to implement least-privilege access models.
Own Microsoft Defender XDR and related security technologies, and monitor and investigate security events across endpoints, identities, email, cloud applications, and infrastructure.
Develop security dashboards, alerts, and operational reporting, improving security visibility through SIEM and security analytics capabilities.
Identify emerging threats and implement proactive mitigation strategies.
Lead the enterprise vulnerability management program, coordinating scanning, remediation, and risk prioritization, and tracking security risks and progress.
Support third-party penetration testing and security assessments, and design and implement secure architecture across cloud, networking, infrastructure, and business applications.
Translate evolving legal, regulatory, contractual, customer, cyber insurance, and industry compliance requirements into practical controls, policies, evidence, and remediation plans.
Lead cybersecurity support for audits and assessments, maintain compliance evidence, identify control gaps, and coordinate remediation with control owners.
Lead disaster recovery and cyber resilience maturity in partnership with infrastructure, application, business, and site leaders, including recovery strategies, standards, roles, runbooks, dependencies, and recurring recovery exercises.
Ensure recovery capabilities address cyberattack scenarios such as ransomware, identity compromise, cloud service disruption, and loss of critical infrastructure.
Work with vendors, managed service providers, consultants, and external partners, and manage ongoing vendor relationships related to performance, deliverables, escalations, and continuous improvement.
Lead security initiatives within Azure and Microsoft 365, including implementing and maintaining Microsoft Defender for Cloud and Secure Score improvements and cloud security governance controls.
Support cloud migration initiatives with secure-by-design principles and collaborate with infrastructure teams to build scalable, secure cloud architectures.
Develop and promote security awareness programs, including phishing simulations and user education.
Assist with cybersecurity due diligence activities related to acquisitions and integrations.
Establish security metrics, KPIs, and executive-level reporting, and support ongoing cybersecurity maturity initiatives.

What you bring

5+ years of hands-on cybersecurity engineering experience in enterprise environments.
Experience with Microsoft security technologies including Microsoft Defender, Entra ID, Intune, Sentinel, and Microsoft 365 Security.
Experience leading or participating in cybersecurity incident response activities.
Experience implementing identity and access management controls.
Experience with vulnerability management programs and remediation processes.
Strong understanding of cybersecurity frameworks, risk management, and defense-in-depth principles.
Strong knowledge of network security, firewalls, endpoint protection, email security, and cloud security.
Experience with security monitoring and SIEM platforms.
Excellent problem solving and analytical skills, with strong communication and documentation abilities.
Ability to work independently and as part of a team.
Experience leading or materially improving disaster recovery, cyber resilience, or business continuity capabilities, including recovery planning and exercises.
Experience aligning cybersecurity controls and programs with evolving regulatory, contractual, customer, or industry compliance requirements.
Demonstrated experience managing security vendors and managed service providers, including deliverables, escalations, and service performance.

Preferred qualifications

CISSP, CISM, Security+, SC-200, SC-300, AZ-500, or equivalent security certifications.
Experience with Microsoft Sentinel and Defender XDR.
Experience securing Azure environments.
Experience with manufacturing or operational technology (OT) environments.
Experience supporting mergers and acquisitions due diligence and integrations.
Experience with penetration testing remediation and security assessments.
Experience with FIDO2, passwordless authentication, and Zero Trust initiatives.

Tools and platforms you’ll work with

Microsoft Defender, Microsoft Defender XDR
Entra ID, Active Directory, Intune, Microsoft 365 Security
Microsoft Sentinel, SIEM, security analytics
Conditional Access, MFA, PIM
FIDO2 and FIDO2 passwordless authentication
Microsoft Defender for Cloud, Secure Score
Azure and Microsoft 365

How Trystar shows up (guiding principles)

Safety – leave facilities in the same or better condition.
Integrity – honest, transparent, committed to doing what is right.
Customer focus – relentless focus on customer success.
Right with speed – good judgment, thoughtful decisions, and purposeful execution.
Play for each other – teamwork and support.
Champion change – adaptation and improvement.
Enjoy the journey – an environment where appreciation and fun are part of the work.

View full job page →

3d ago

Senior Security Engineer

GORILLA GLUE COMPANY Sharonville, OH

Sharonville, OH

3d ago

Full time Senior Cloud Platforms Cloud Security

Apply Now

Job Description

Gorilla Glue Company is seeking a primary technical cybersecurity expert to design, implement, operate, and validate security controls across identity, endpoint, cloud, data protection, and security operations.

Key Responsibilities

Administer and continuously improve Microsoft Entra ID security controls including Conditional Access, MFA, Privileged Identity Management (PIM), access reviews, and privileged-access hygiene
Configure, operate, and optimize Microsoft Defender capabilities across endpoint, identity, email, cloud applications, and related security workloads
Design and implement Microsoft Purview controls for data classification, data loss prevention, information protection, and secure AI adoption
Maintain working knowledge of SIEM integrations, security telemetry, KQL, and Microsoft Sentinel to support a managed detection environment
Design and implement security controls across Microsoft 365, Azure, hybrid identity, endpoints, servers, cloud services, and business technology environments
Conduct security architecture reviews and technical risk assessments for new systems, projects, integrations, vendors, and cloud services
Develop security automation using PowerShell, KQL, APIs, and orchestration capabilities to improve consistency, visibility, and response speed
Establish technical standards, configuration baselines, implementation documentation, and operational runbooks for security controls
Lead vulnerability and exposure prioritization using threat intelligence, exploitability, asset criticality, and business impact
Partner with Infrastructure, application owners, and service providers to plan remediation, validate fixes, manage exceptions, and report aging and risk trends
Validate deployment and coverage of required security agents, logging, integrations, and monitoring across in-scope assets
Provide technical leadership during cybersecurity investigations and incidents, including scoping, containment, eradication, recovery, and lessons learned
Coordinate with MDR/SOC providers on escalations, investigations, detection quality, telemetry gaps, and response actions
Support phishing investigations, identity investigations, endpoint analysis, cloud investigations, and data protection events
Translate technical findings into clear remediation actions, risk statements, and status updates for security leadership and control owners
Partner with Plant IT teams to strengthen cybersecurity posture of manufacturing and OT environments
Assist with design, implementation, and ongoing management of network segmentation and connected manufacturing technology
Evaluate cybersecurity risks associated with industrial operations, control systems, and connected manufacturing technologies
Ensure cyber security controls align with industry best practices, regulatory expectations, and corporate security standards
Support Information Security policies, standards, and compliance requirements
Maintain security documentation, diagrams, and procedures
Assist with vendor security reviews and risk assessments
Support audits and cybersecurity assessments

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent professional experience
5+ years of progressive experience in security engineering, cybersecurity operations, cloud security, identity security, or related disciplines
Hands-on experience securing Microsoft 365, Azure, hybrid identity, endpoints, and cloud services
Experience with vulnerability management, technical incident response, security monitoring, and remediation validation
Practical experience with PowerShell, KQL, APIs, or other scripting and automation technologies
Deep working knowledge of Microsoft Entra ID, Conditional Access, MFA, PIM, Microsoft Defender XDR, and Microsoft Purview
Strong understanding of identity and access management, endpoint security, cloud security, data protection, logging, and zero trust concepts
Ability to troubleshoot complex security issues, assess technical risk, and design practical controls for hybrid environments
Ability to work effectively with Infrastructure, Service Desk, application owners, data teams, vendors, and managed security providers
Strong analytical, documentation, communication, and project execution skills

Technologies

Microsoft Entra ID
Conditional Access
Multifactor authentication
Privileged Identity Management
Microsoft Defender
Microsoft Purview
SIEM
KQL
Microsoft Sentinel
Microsoft 365
Azure
PowerShell
APIs
MDR/SOC providers
Microsoft Defender XDR
Zero trust

Preferred Certifications

Microsoft Cybersecurity Architect Expert (SC-100) preferred
Microsoft Security Operations Analyst (SC-200), Identity and Access Administrator (SC-300), Information Protection and Compliance Administrator (SC-400), Azure Security Engineer Associate (AZ-500) beneficial
CISSP or equivalent security certification helpful but not required

Benefits

Competitive compensation packages
Comprehensive healthcare benefits
Other perks and incentives
Recognized as a top place to work for 16 years in a row

Company Values

Have fun, be passionate and show it
Act with integrity and respect in all relationships
Communicate openly and appreciate the effort of others
Embrace knowledge, growth, and change
Strive for excellence in what we do every day

Location: Sharonville, OH (onsite)

View full job page →

Security Siem Engineer Jobs

Senior Security Engineer- Security Operations

Cyber Security Engineer

Senior Security Engineer

Get Security Siem Engineer Jobs alerts