Senior Security Operations Engineer (SIEM / SOAR)

Role Overview

We are seeking an experienced Senior Security Operations Engineer (SIEM / SOAR) to lead the design, implementation, and optimization of enterprise security monitoring and automation capabilities within a highly regulated environment.

This role will be responsible for engineering and managing Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) platforms while supporting enterprise-scale security monitoring, threat detection, and incident response initiatives. The successful candidate will play a critical role in enhancing security visibility, automating response workflows, and ensuring monitoring controls remain effective, resilient, and audit-ready.

The ideal candidate will possess strong expertise in IBM QRadar, Microsoft Sentinel, SIEM Engineering, SOAR Automation, Detection Engineering, Threat Monitoring, and Security Operations, with experience working in large-scale Security Operations Centers (SOC) and regulated environments. [

Key Responsibilities

SIEM Engineering & Platform Management

• Design, implement, and maintain enterprise SIEM platforms including IBM QRadar and Microsoft Sentinel.
• Manage log onboarding, parsing, normalization, and monitoring across infrastructure, cloud, identity, application, database, and endpoint environments.
• Design scalable SIEM architectures, including data retention, workspace design, performance optimization, and capacity planning.
• Monitor platform health and ensure continuous log collection visibility across all critical sources.
• Manage SIEM upgrades, lifecycle management, platform maintenance, and optimization activities.

SIEM Modernization & Migration

• Support or lead SIEM transformation and migration initiatives, including QRadar to Microsoft Sentinel migrations.
• Translate existing detection content into modern cloud-native detection capabilities.
• Ensure continuity of security monitoring, detection coverage, and historical log access during platform transitions.

Detection Engineering

• Develop, tune, and maintain security detections aligned with threat intelligence and the MITRE ATT&CK framework.
• Build and improve use cases focused on cyber threats impacting financial services and enterprise environments.
• Continuously optimize detection logic to improve alert fidelity and reduce false positives.

SOAR & Automation

• Design and implement security automation workflows and SOAR playbooks.
• Automate enrichment, investigation, triage, containment, notification, and response activities.
• Integrate SIEM and SOAR platforms with EDR, threat intelligence, identity platforms, and ITSM solutions.

Governance & Operational Support

• Support SOC analysts and incident response teams during major security events.
• Develop and maintain technical documentation, architecture diagrams, runbooks, and operational procedures.
• Support audits, regulatory reviews, and compliance assessments with evidence of control effectiveness.
• Track and report platform performance, coverage metrics, and operational effectiveness.

Required Skills & Qualifications

• 5-10 years of experience in Security Operations, SIEM Engineering, Detection Engineering, or Cybersecurity Operations.

• Proven expertise in:

  • IBM QRadar
  • Microsoft Sentinel
  • SIEM Engineering
  • SOAR Automation
  • Detection Engineering
  • Security Monitoring

• Strong hands-on experience with:

  • KQL (Kusto Query Language)
  • AQL
  • Microsoft Sentinel Analytics Rules
  • QRadar Rule Development
  • Log Parsing & Normalization

• Experience with:

  • Syslog
  • CEF
  • APIs
  • Azure Monitor Agent (AMA)
  • Data Collection Rules (DCRs)

• Strong understanding of:

  • MITRE ATT&CK
  • Threat Detection Methodologies
  • SOC Operations
  • Incident Response Processes

• Experience working with:

  • Microsoft Defender XDR
  • Microsoft Entra ID
  • Azure Security Services

• Scripting experience in:

  • PowerShell
  • Python

• Excellent analytical, troubleshooting, and stakeholder management skills.

Preferred Skills & Experience

• Experience delivering SIEM migrations, particularly QRadar to Microsoft Sentinel.
• Banking or financial services industry experience.
• Experience supporting 24x7 Security Operations Centres.
• Knowledge of regulatory standards including PCI DSS and banking security frameworks.
• Experience integrating threat intelligence and endpoint security platforms.
• Familiarity with Infrastructure as Code (Terraform, ARM, Bicep).
• Experience implementing CI/CD pipelines for detection content and security engineering.

Certifications

Preferred

• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• IBM QRadar Certified Administrator
• IBM QRadar Deployment Professional
• CISSP
• GIAC GCIA
• GIAC GCIH
• GIAC GCDA

Education & Qualifications

• Bachelor's degree in Computer Science, Information Security, Engineering, or a related discipline.
• Relevant certifications in SIEM, Security Operations, Cloud Security, or Cybersecurity Engineering are highly desirable.

Halian Group

With over 28 years of experience, we have come to understand that innovation is the only way to provide agile, practical solutions that transform businesses and careers. Our resourcing and smart services help you to realise tomorrow's potential. Discover the amazing things possible when you bring the right people and the right technologies together.

At Halian, we recognise that diversity, equity, and inclusion (DEI) are essential to building high-performing teams for our clients. We are committed to connecting organisations with top talent from all backgrounds, ensuring that every individual feels valued, respected, and empowered to contribute their unique perspectives.

We encourage applications from all qualified candidates, regardless of race, gender, disability, or any other characteristic that makes them unique.

#LI-CC1