Design, implement, and optimize SIEM solutions to meet evolving business needs
Build and manage SIEM workflows and connectors, ensuring seamless integration of various data sources
Develop, test, and tune Kibana Security detection rules
Investigate Kibana Security alerts and document findings, scope, and recommended actions
Analyze telemetry across identity, endpoint, network, and cloud data sources
Improve alert fidelity through tuning, exception management, and rule lifecycle maintenance
Map detection logic to MITRE ATT&CK and maintain investigation guidance
Build dashboards, saved searches, and queries to support investigations and operational visibility
Partner with SecOps, IR, IAM, cloud, and infrastructure teams to improve detection coverage and response quality
Identify data quality gaps, field mapping issues, and logging deficiencies that affect detection quality

5 years of experience in security operations, detection engineering, threat detection, or incident response
Experience with Elastic Security / Kibana or a similar SIEM platform
Demonstrated experience writing and tuning detections using KQL, EQL, ES|QL, SPL, or similar query languages
Possess knowledge of common log sources such as authentication, endpoint, network, and cloud audit logs
Familiarity with cloud security concepts, especially AWS
Understanding of MITRE ATT&CK, alert triage, and false positive reduction
Working knowledge of scripting in Python or Bash

Security Engineer II – Security Clearance

Key skills