Principal SIEM Engineer - Vice President

Morgan Stanley•Baltimore, MD

6d•$140,000 - $195,000

About The Position

Morgan Stanley’s Cyber Response Platforms team is seeking an experienced cybersecurity professional to work as a SIEM Engineer. The role focuses on developing and tuning detection analytics, supporting SIEM platforms, producing security metrics and dashboards, and integrating SIEM capabilities into broader cyber response workflows. The ideal candidate has hands-on computer network defense experience in a Security Operations Center or Cyber Incident Response Team and contributes to a collaborative, inclusive culture of innovation, ownership, and continuous improvement.

Requirements

10+ years of cybersecurity experience.
Hands-on computer network defense experience in a Security Operations Center or Cyber Incident Response Team.
Experience creating and managing detection logic in SIEMs such as Elastic Search, Splunk, ArcSight, or Microsoft Sentinel.
Experience developing SOAR automations using platforms such as Palo Alto XSOAR, SumoLogic, or Swimlane.
Experience with SIEM rule tuning, correlation logic, alert de-duplication, and false-positive reduction.
Strong knowledge of exploitation techniques, such as MITRE ATT&CK, and use-case development.
Experience applying Indicators of Compromise, such as YARA rules, STIX, and TAXII.
Experience with data normalization technologies such as Kafka, NiFi, or Spark.
Experience with CI/CD technology such as Jenkins, GitLab CI, or GitHub Actions.
Intermediate experience developing scripts in Python.
Strong communication, task management, and organizational skills.

Responsibilities

Develop analytics in Elastic Search to detect actionable security alerts.
Develop and fine-tune advanced detection rules, alerting mechanisms, and use cases to identify and respond to sophisticated security threats.
Monitor and support SIEM platforms to ensure the security and stability of SOC infrastructure.
Create security metrics, reports, and dashboards that provide insight into the organization's security posture.
Collaborate with cross-functional teams to integrate SIEM capabilities into broader cyber response workflows.
Champion a collaborative and inclusive team culture that encourages innovation, ownership, and continuous improvement.