Security Engineer – SIEM/SOAR

GuidePoint Security

. Architect, deploy, and maintain SIEM platforms including CrowdStrike, Microsoft Sentinel, Splunk, Elastic, and Google SecOps .

Posted 10/13/2026full-timeRemote • United StatesMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in architecting, deploying, and maintaining SIEM and SOAR platforms, with a strong focus on developing detection rules and operational dashboards. Proficient in log ingestion strategies and capable of integrating security tools while ensuring compliance and optimizing performance.

Highest-signal resume keywords

SIEM ArchitectureSOAR ImplementationLog Ingestion StrategiesDetection Rule DevelopmentScripting in Python

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SIEM PlatformsSOAR PlatformsLog IngestionDetection LogicWindows Operating SystemMac Operating SystemLinux Operating SystemBASH ScriptingPerl ScriptingPython Scripting

Soft Skills

Analytical SupportClient CommunicationProject Prioritization

Tools & Technologies

CrowdStrikeMicrosoft SentinelSplunkElasticGoogle SecOpsPalo Alto XSOARTinesTorq

Industry Keywords

MITRE ATT&CKSOC OperationsThreat DetectionComplianceIncident Response

Tech Stack

Tools & technologies

CloudFirewallsJavaLinuxPerlPythonSplunk

About the role

Key responsibilities & impact

Architect, deploy, and maintain SIEM platforms including CrowdStrike, Microsoft Sentinel, Splunk, Elastic, and Google SecOps
Onboard and tune cloud, identity, endpoint, network, email security, SaaS, and line-of-business application log sources
Develop, test, and tune MITRE ATT&CK-mapped detection rules, correlation searches, and analytics
Build dashboards, reports, and metrics for SOC operations, leadership, and audit/compliance needs
Monitor SIEM health, data quality, ingestion costs, and performance and recommend optimizations
Design, build, and maintain SOAR playbooks for triage, enrichment, containment, and case management
Integrate security and IT tools via APIs, including EDR, identity, ticketing, threat intelligence, email gateways, and vulnerability scanners
Automate phishing response, account compromise, malware triage, and user-behavior alert workflows
Establish version control, testing, and change-management practices for detections and playbooks
Measure and report automation impact, including mean time to detect/respond and analyst hours saved
Partner with SOC analysts, incident responders, threat hunters, and threat intelligence teams
Work with IT, cloud, and application teams on logging and onboarding standards
Support client-facing security questionnaires, audits, and assessments with evidence and documentation
Maintain runbooks, data source inventories, detection catalogs, and architecture diagrams
Participate in on-call or after-hours support rotations for critical platform issues and major incidents as needed
Provide technical troubleshooting, analytical support, client communication, and client-focused service

Requirements

What you’ll need

3-5 years of architecture, implementation, and troubleshooting experience with one or more SIEM/SOAR solutions
Proficiency developing log ingestion and aggregation strategies
Expertise developing security-focused content for one or more SIEM platforms, including complex threat detection logic and operational dashboards
Expertise with SOAR platforms such as Splunk SOAR, Palo Alto XSOAR, Tines, and Torq
Familiarity with key security events on common IT platforms
Deep proficiency in Windows, Mac, and Linux operating systems
General networking and security troubleshooting, including firewalls, routing, and NAT
Scripting and development skills in BASH, Perl, Python, or Java
Strong knowledge of regular expressions
Ability to autonomously prioritize and successfully deliver across a portfolio of projects
Willingness to embrace emerging technologies, including AI tools
Sedentary work capability
Substantial movement of wrists, hands, and/or fingers for a minimum of 8 hours a day
Close visual acuity for computer terminal viewing and/or extensive reading for a minimum of 8 hours a day
U.S.-based work authorization/location requirement

Benefits

Comp & perks

Remote workforce primarily (U.S. based only)
Group Medical Insurance options: Zero Deductible PPO Plan with GuidePoint paying 90% of the employee premium and 70% of family premiums, or High Deductible Health Plan with HSA with GuidePoint paying 100% of the employee premium and 75% of family premiums
HSA contributions of $850 annually per employee or $1,750 annually per family plan
Group Dental Insurance with GuidePoint paying 100% of the employee premium and 75% of family premiums
12 corporate holidays
Flexible Time Off (FTO) program
Healthy mobile phone and home internet allowance
Eligibility for retirement plan after 2 months at open enrollment
Pet Benefit Option
Mentorship and guidance opportunities
Up to 10% travel may be required