SIEM Security Engineer

About the role

EY's Information Security team protects its own and its clients' information assets. Within the Security Technology Services (STS) group, a SIEM Security Engineer joins a global team responsible for the full life cycle of security solutions and services: design, engineering, implementation and early-life support in multi-cloud and on-premises environments. The role works closely with Security Architects, Security Service Delivery, Security Operations and Information Security teams, and provides consulting and escalation support to other teams.

Key responsibilities

• Engineer security solutions and services following EY standards for on-premise, hybrid and cloud-based environments
• Plan, design and implement SIEM solutions in multi-cloud environments such as Azure, AWS, GCP or similar
• Implement data pipelines, data collection, out-of-the-box connectors, Linux configuration and Syslog/CEF
• Configure data retention in the Sentinel platform and test, deploy and configure Azure Monitoring Agent and Azure ARC
• Manage Azure RBAC for Microsoft Sentinel and Log Analytics at tenant, subscription, resource and table level
• Use KQL queries and functions, and understand Analytic rules, Logic Apps, Azure Functions and other cloud workflow tools
• Own the implementation, integration, delivery and maintenance of new and existing SIEM solutions

Required profile

• About 5-7 years of security experience, including demonstrable SIEM knowledge
• 3+ years of proven engineering experience
• Functional, technical and delivery experience implementing cloud and on-premises SIEM solutions
• Fluent written and spoken English, with strong communication and organisational skills
• Comfortable working in a diverse, matrixed global environment and with offshore team members
• Willingness to work off hours occasionally for complex changes

Required skills

• Azure, Google and/or AWS cloud services, hybrid and on-premises security, including Linux and Windows
• SaaS, IaaS and PaaS solutions
• APIs and scripting tools (Python, Ansible, PowerShell) is a plus
• Ideally: Bachelor's degree in a related field, GSEC/GCLD/CISSP/GCSP or similar certification, and at least one public cloud provider certification

What we offer

• A globally diverse team with opportunities to grow and develop
• Flexible working arrangements, including the option to work from home
• An EY benefits package covering physical, emotional, financial and social well-being