SIEM Engineer

Job Summary

To enhance the CrowdStrike Falcon Next-Gen SIEM service, the full-time remote SIEM Engineer will onboard third-party sources, develop parsers to the CrowdStrike Parsing Standard, and create detection content to ensure comprehensive visibility across the environment.

Key responsibilities

• Onboard and normalize data from firewalls, identity providers, cloud control planes, and SaaS applications
• Develop and test parsers to meet the CrowdStrike Parsing Standard
• Create detection content and maintain runbooks for the SOC's operational efficiency

Required qualifications

• Hands-on experience with SIEM engineering tools such as Falcon NG-SIEM, LogScale/Humio, Splunk, or Sentinel
• Proficiency in regex, JSON, and at least one scripting language
• Understanding of log sources and their recording mechanisms, including domain controllers and firewalls
• Experience with pipeline tools like Cribl, Onum, or Logstash is a strong plus
• Possession of a CrowdStrike certification is advantageous