1 week ago

Security Operations Center - SIEM Architect

Vanderlande

Veghel

1 week ago

Apply

Vanderlande's Security Operations Center (SOC) is looking for a SIEM Engineer with experience designing, operating, and optimizing enterprise security monitoring platforms. The role involves log ingestion, detection engineering, alert tuning, and dashboard development to support SOC operations, incident response, and compliance requirements. The position offers a competitive salary and a hybrid workplace.

HybridFull-timeMid LevelSplunkMicrosoft Sentinel

Security Operations Center - SIEM Architect

Apply

HybridFull-timeMid LevelSplunk

Salary

Not specified

Work Location

Veghel, North Brabant, Netherlands, NL

Work Model

Hybrid: 40% working from home and 60% in the office

Experience Required

4 years

Employment Type

Full-time

Experience Level

4+ years in cybersecurity, SIEM engineering, SOC operations, or related role

Core Qualifications

Technical (Must-have)

SplunkMicrosoft SentinelExabeamElasticWindows Event LogsLinux SyslogFirewallProxyIAMEDRAzure MonitorAWS CloudTrailGCP LoggingMITRE ATT&CKNISTIncident Response LifecyclePythonPowerShellBashTCP/IPDNSHTTP/S

Soft Skills

AnalyticalProblem-solvingCommunicationAttention to detailDocumentationIndependentCollaborative

Key Responsibilities

•Onboards log sources (Windows, Linux, firewalls, cloud, SaaS apps)
•Parses and normalizes logs so data is searchable and consistent
•Creates detection rules and alerts for threats (e.g., brute force, malware, insider risk)
•Tunes alerts to reduce false positives
•Builds dashboards and reports for SOC teams and leadership
•Maintains performance and reliability of the SIEM
•Supports incident response by helping analysts investigate alerts
•Ensures compliance (e.g., log retention for NIS2, ISO 27001, IEC62443)
•Engineered and maintained multitenant SIEM platforms supporting enterprise-scale security monitoring
•Onboarded and normalized logs from servers, endpoints, network devices, cloud services, and security tools (EDR, IAM, IDS firewalls)
•Developed and tuned correlation rules, detections, and alerts, reducing false positives and improving threat detection accuracy
•Mapped detections to the MITRE ATT&CK framework to strengthen coverage of adversary techniques
•Built operational and executive dashboards to improve SOC visibility and reporting
•Integrated threat intelligence feeds to enhance detection capabilities
•Supported SOC analysts during investigations by providing log analysis and forensic context
•Automated SIEM tasks and data processing using Python, PowerShell, and Bash
•Optimized log retention and storage to balance performance, cost, and regulatory requirements
•Documented SIEM architecture, detections, and onboarding processes for audit readiness

Security Operations CenterSIEMArchitectCybersecurityHybridFull-timeVanderlandeNetherlands

Core Qualifications

Technical (Must-have)

Soft Skills

AnalyticalProblem-solvingCommunicationAttention to detailDocumentationIndependentCollaborative

Key Responsibilities

•Onboards log sources (Windows, Linux, firewalls, cloud, SaaS apps)

•Parses and normalizes logs so data is searchable and consistent

•Creates detection rules and alerts for threats (e.g., brute force, malware, insider risk)

•Tunes alerts to reduce false positives

•Builds dashboards and reports for SOC teams and leadership

•Maintains performance and reliability of the SIEM

•Supports incident response by helping analysts investigate alerts

•Ensures compliance (e.g., log retention for NIS2, ISO 27001, IEC62443)

•Engineered and maintained multitenant SIEM platforms supporting enterprise-scale security monitoring

•Onboarded and normalized logs from servers, endpoints, network devices, cloud services, and security tools (EDR, IAM, IDS firewalls)

•Developed and tuned correlation rules, detections, and alerts, reducing false positives and improving threat detection accuracy

•Mapped detections to the MITRE ATT&CK framework to strengthen coverage of adversary techniques

•Built operational and executive dashboards to improve SOC visibility and reporting

•Integrated threat intelligence feeds to enhance detection capabilities

•Supported SOC analysts during investigations by providing log analysis and forensic context

•Automated SIEM tasks and data processing using Python, PowerShell, and Bash

•Optimized log retention and storage to balance performance, cost, and regulatory requirements

•Documented SIEM architecture, detections, and onboarding processes for audit readiness