Senior Information Security Engineer – SIEM and Detection

Faegre Drinker • Washington, DC

2d • $160,200 - $183,100 • Hybrid

About The Position

Faegre Drinker has an opportunity for a Senior Information Security Engineer – SIEM and Detection to work with our Technology & Innovation team in our Philadelphia, New York City, or Washington, D.C. offices. You will be part of a dynamic team responsible for owning the firm’s security monitoring platform and the detection capability built on it. This position will work with other talented individuals who share a passion for doing great work in the best interest of our clients.

Requirements

• Bachelor’s degree in cybersecurity, information systems, or a related field, or equivalent years of experience
• Eight years or more of relevant information security experience, including security operations and incident response in an enterprise environment
• Hands-on experience engineering a SIEM platform, including log source onboarding, forwarding infrastructure, parsing and normalization, and at least one major deployment or migration
• Experience developing and tuning detections, with working knowledge of the MITRE ATT&CK framework and query languages such as KQL or equivalent
• Experience owning the configuration of an enterprise EDR platform, including policy management, tuning, integrations, and containment actions. CrowdStrike Falcon experience strongly preferred
• Demonstrated experience leading incident response, including building or maintaining incident response plans and playbooks and running tabletop exercises
• Experience managing a managed detection and response or managed security service provider relationship as the primary technical counterpart, including tuning, escalation, and service reviews
• Working knowledge of Microsoft security tooling, including Microsoft Defender, Microsoft Entra ID, Microsoft 365, and Microsoft Purview
• Working knowledge of network security, firewalls, and email security controls.
• Thorough understanding of current security principles, techniques, and protocols.
• Ability to effectively communicate information security issues, risks, and recommendations to both technical and non-technical peers and management, including through well-written reports

Nice To Haves

• Ability to problem-solve
• Excellent interpersonal, verbal and written communication skills, including the ability to communicate effectively in a virtual environment (e.g., via phone, web/videoconference)
• Ability to concentrate on tasks, make decisions and work calmly and effectively in a high-pressure, deadline-orientated environment
• Demonstrated ability to use good judgment in taking initiative while asking for direction or clarification and consulting others, as appropriate
• Willingness to be flexible with time and adjust to a changing work environment
• Ability to build and maintain positive relationships, both internally and externally, while maintaining a client service orientation
• Ability to use sound judgment and discretion in dealing with highly confidential information
• Ability to take direction and accept supervision
• Demonstrated ability to work independently, organize and accurately prioritize work, be detail-oriented, understand when urgency is required and use good judgment in varied situations
• Ability to work effectively with co-workers in a team oriented collaborative environment

Responsibilities

• Owns the architecture, configuration, health, and performance of the firm’s SIEM platform, including data ingestion, parsing, normalization, retention, and cost management, in partnership with CrowdStrike as the managed security service provider
• Onboards and maintains log sources across Microsoft Defender, Microsoft Entra ID, Microsoft 365, Microsoft Purview, Azure, CrowdStrike, network and firewall infrastructure, and key business applications, using Event Hub, Graph API, and native connectors as appropriate
• Designs, builds, tests, and tunes detection rules and analytics mapped to the MITRE ATT&CK framework, prioritizing coverage based on the firm’s threat profile and risk
• Serves as senior technical lead for the Security Incident Response Team, guiding investigations from analysis and containment through recovery and reporting, and advising the Director and leadership on response decisions
• Owns the firm’s Incident Response Plan and playbooks, maintaining them as the firm’s environment, threats, and regulatory obligations evolve
• Owns the configuration of the CrowdStrike Falcon platform and its related modules across all firm endpoints and identities, including EDR, Identity Protection, Data Protection, prevention and update policies, integrations, and day-to-day tuning, along with adjacent security technologies that feed or act on Falcon data
• Builds security automation and orchestration workflows for common response actions, enrichment, and case management, integrating the SIEM, CrowdStrike, and ServiceNow
• Special projects and other duties as assigned

Benefits

• Flexible working environment for work-life success
• Opportunity to participate in firm-sponsored volunteer events
• Wellness programming with personalized content and activities
• Professional environment and the opportunity to work with experts at the top of their fields
• Variety of health plan options, as well as dental, vision and 401(k) plans
• Generous paid time off

What This Job Offers

• Job Type: Full-time
• Career Level: Senior