Cyber Defense Engineer - SIEM

NorthMark Strategies • Dallas, TX

1d

About The Position

The Cyber Defense Engineer – SIEM reports to the Director of Cyber Defense and operates within the Office of the CISO. The role architects, develops, and implements security solutions to enhance cyber defense investigations and incident response, with a strong emphasis on AI-driven security engineering. The engineer develops intelligent detection systems, automation pipelines, and data-driven defense mechanisms, applying expertise in the Microsoft security ecosystem and artificial intelligence and machine learning to improve SIEM/SOAR performance, detection fidelity, and operational efficiency. The role works across IT and security teams to design scalable logging, enrichment, and response architectures and advance AI-enabled SIEM engineering maturity.

The position requires legal authorization to work in the United States without employer sponsorship now or in the future. The job description notes that its responsibilities and requirements are not exhaustive and may change with business needs.

Requirements

• Bachelor’s degree in computer science, Information Security, or a related field.
• 4–6+ years of experience in cybersecurity engineering, SOC engineering, or insider threat.
• Demonstrated expertise in SIEM engineering and security monitoring at scale.
• Experience integrating or developing AI/ML capabilities within security operations or detection engineering.
• Strong understanding of the Microsoft security stack, such as Sentinel and the Defender suite.
• Proficiency with automation tooling and scripting languages, including KQL, Python, and PowerShell.
• Proficiency in API development for integrating security tooling.
• Familiarity with log ingestion methodologies into a SIEM environment.
• Highly motivated self-starter who positively influences the environment.
• Legally authorized to work in the United States without employer sponsorship, now or in the future.

Nice To Haves

• Experience in multi-tenant or MSP-like environments.

Responsibilities

• Design, develop, and deploy AI-enhanced detections and automations within the SIEM/SOAR platform to improve signal-to-noise ratio and reduce alert fatigue.
• Engineer and optimize SIEM pipelines using AI/ML for anomaly detection, behavioral analytics, and threat correlation.
• Integrate SIEM with security tools and data sources to build a context-rich, intelligence-driven monitoring ecosystem.
• Develop and implement AI-assisted threat detection models, including UEBA and predictive analytics.
• Collaborate with cyber defense operations to identify emerging threats and capability gaps, using AI to strengthen defenses proactively.
• Build and maintain automated response orchestration and intelligent playbooks that adapt to threat context.
• Design automation for alert enrichment, triage, and response using rule-based and AI-assisted decision frameworks.
• Partner with IT and engineering teams to support comprehensive telemetry collection and high-quality data pipelines.
• Improve SIEM engineering practices, including data normalization, enrichment strategies, and AI model tuning.
• Support SOC operations by improving detection engineering, incident response workflows, and operational metrics through AI augmentation.

Benefits

• Company-paid lunch stipend provided via Grubhub.
• 100% employer-paid medical coverage in the High Deductible Health Plan, dental and vision benefits for employees and their families.
• 16 weeks of paid parental leave.
• Employee Assistance Program.
• Life insurance.
• Short-term disability and long-term disability coverage.
• 401(k) match of 100% of employee contributions up to 6%.
• Optional employee-paid PPO medical insurance and other benefits, including Health Savings Accounts with a company contribution, Flexible Spending Accounts, supplemental life insurance, and Wellhub.
• 25 days of paid time off plus 12 company holidays.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level