Principal SIEM Engineer - Vice President

Morgan Stanley•Baltimore, MD

About The Position

Morgan Stanley’s Cyber Response Platforms team is seeking an experienced cybersecurity professional to work as a SIEM Engineer. The role focuses on developing and maintaining security information and event management capabilities that support the organization’s cyber response operations. The ideal candidate has hands-on computer network defense experience from a Security Operations Center or Cyber Incident Response Team. The engineer will develop analytics in Elastic Search to identify actionable security alerts; create and refine detection rules, alerting mechanisms, and use cases for sophisticated threats; monitor and support SIEM platforms; and produce security metrics, reports, and dashboards that provide insight into the organization’s security posture. The role also collaborates with cross-functional teams to integrate SIEM capabilities into broader cyber response workflows and contributes to a collaborative, inclusive culture focused on innovation, ownership, and continuous improvement.

Requirements

10+ years of experience as a cybersecurity professional.
Hands-on computer network defense experience in a Security Operations Center or Cyber Incident Response Team.
Experience creating and managing detection logic in SIEMs such as Elastic Search, Splunk, ArcSight, or Microsoft Sentinel.
Experience developing SOAR automations, such as with Palo Alto XSOAR, SumoLogic, or Swimlane.
Experience with SIEM rule tuning, correlation logic, alert de-duplication, and false-positive reduction techniques.
Strong knowledge of exploitation techniques, such as MITRE ATT&CK, and use-case development.
Experience applying Indicators of Compromise, such as YARA rules, STIX, and TAXII.
Experience with data normalization, such as Kafka, NiFi, or Spark.
Experience with CI/CD technology, such as Jenkins, GitLab CI, or GitHub Actions.
Intermediate experience developing scripts in Python.
Strong communication, task management, and organizational skills.

Responsibilities

Develop analytics in Elastic Search to detect actionable security alerts.
Develop and fine-tune advanced detection rules, alerting mechanisms, and use cases to identify and respond to sophisticated security threats.
Monitor and support SIEM platforms to ensure the security and stability of SOC infrastructure.
Create security metrics, reports, and dashboards that provide detailed insights into the organization's security posture.
Collaborate with cross-functional teams to integrate SIEM capabilities into broader cyber response workflows.
Champion a collaborative and inclusive team culture that encourages innovation, ownership, and continuous improvement.

Benefits

Medical insurance
Prescription drug coverage
Dental insurance
Vision insurance
Health Savings Account
Dependent Day Care Savings Account
Life insurance
Disability and other insurance plans
Paid time off, including sick leave consistent with state and local law
Parental leave
20 vacation days annually
10 paid holidays
401(k)
Short- and long-term disability coverage
Potential eligibility for annual discretionary incentive compensation and business-unit incentive compensation, which may include a discretionary bonus
Other employee perks