Security Engineer - SIEM/SOAR - Northeast region

GuidePoint Security provides cybersecurity expertise, solutions, and services to help organizations minimize risk. The Security Engineer supports clients by implementing, optimizing, and operating SIEM/SOAR technologies, security telemetry pipelines, detection content, and automation workflows.

Responsibilities:

• Architect, deploy, and maintain the SIEM platforms (e.g., CrowdStrike, Microsoft Sentinel, Splunk, Elastic, Google SecOps), including data ingestion, parsing, normalization, and retention
• Onboard and tune log sources across cloud (Azure, AWS, GCP), identity (Entra ID, Okta, Active Directory), endpoint (EDR), network, email security, SaaS, and line-of-business applications
• Develop, test, and tune detection rules, correlation searches, and analytics mapped to MITRE ATT&CK; reduce false positives and close detection gaps
• Build dashboards, reports, and metrics for SOC operations, leadership, and audit/compliance needs
• Monitor SIEM health, data quality, ingestion costs, and performance; recommend optimizations
• Design, build, and maintain SOAR playbooks (e.g., Palo Alto XSOAR, Splunk SOAR, Sentinel automation/Logic Apps, Tines, Torq) for triage, enrichment, containment, and case management
• Integrate security and IT tools via APIs, including EDR, identity, ticketing (ServiceNow/Jira), threat intelligence platforms, email gateways, and vulnerability scanners
• Automate high-volume use cases such as phishing response, account compromise, malware triage, and user-behavior alerts
• Establish version control, testing, and change-management practices for detections and playbooks (detection-as-code)
• Measure and report automation impact (e.g., mean time to detect/respond, analyst hours saved)
• Partner with SOC analysts, incident responders, threat hunters, and threat intelligence to turn lessons learned into new detections and automations
• Work with IT, cloud, and application teams to ensure appropriate logging and onboarding standards
• Support client-facing security questionnaires, audits, and assessments (e.g., SOC 2, ISO 27001, NIST, client-specific requirements) with evidence and documentation
• Maintain clear documentation: runbooks, data source inventories, detection catalogs, and architecture diagrams
• Participate in on-call or after-hours support rotation for critical platform issues and major incidents, as needed

Requirements:

• The Security Engineer must demonstrate strong technical troubleshooting, analytical, and client communication skills
• The engineer must lead through influence and apply sound business and financial awareness when making technical decisions involving project scope, level of effort, platform performance, data volume, and client value
• 3-5 years of architecture, implementation, and troubleshooting experience with one or more SIEM/SOAR solutions
• Proficiency developing log ingestion and aggregation strategies
• Expertise developing security-focused content for one more SIEM platforms (Splunk ES, CrowdStrike NG-SIEM, Elastic Security, Palo Alto XSIAM, Google SecOps, Microsoft Sentinel, Sentinel One AI SIEM), including creation of complex threat detection logic and operational dashboards
• Expertise with SOAR platforms (Splunk SOAR, Palo Alto XSOAR, Tines, Torq)
• Familiarity with key security events on common IT platforms
• Deep proficiency in client and server operating systems including Windows, Mac, and Linux
• General networking and security troubleshooting (firewalls, routing, NAT, etc.)
• Scripting and development skills (BASH, Perl, Python or Java) with strong knowledge of regular expressions
• Ability to autonomously prioritize and successfully deliver across a portfolio of projects
• Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes
• Experience with platforms such as Ansible, Puppet, Chef, Terraform and SaltStack
• Experience with other Information Security solutions including CrowdStrike, SentinelOne, ZScaler, Palo Alto Networks, Check Point, Microsoft Defender products, Carbon Black, Splunk, and/or Cisco
• Experience authoring security runbooks, policy, and best practice documentation