Senior SIEM Engineer

DTCC • Tampa, FL

3d • Hybrid

About The Position

As a member of DTCC’s CISO team, the Senior SIEM Engineer reports to the Associate Director, Cyber Threat Defense and Controls, within the Cybersecurity Engineering & Operations team. The role is responsible for day-to-day decisions and implementation of the SIEM roadmap. SIEM capabilities include security logging and monitoring, logging platforms, database activity monitoring, behavior analytics, security orchestration, automation and response (SOAR), intrusion detection and prevention systems, and incident response capabilities.

The Cybersecurity Services domain focuses on protecting DTCC from cybersecurity risks through cyber risk management, talent, and governance practices. Cybersecurity Engineering provides enterprise security services, including security information and event management, vulnerability management, identity and access management, cloud security, and network security. The role engineers and maintains SIEM and Central Log Management platforms and pipelines, improves telemetry coverage and data quality, supports platform resilience and regulatory requirements, and works with operations, security monitoring teams, infrastructure and application owners, and vendors.

DTCC offers a flexible/hybrid work model with three days onsite and two days remote. The onsite days are Tuesdays, Wednesdays, and a third day determined by the team or employee.

Requirements

• Minimum of 6 years of related experience.
• Hands-on experience engineering SIEM and Central Log Management platforms, including collectors, connectors, ingestion pipelines, parsers, normalization, and security telemetry integration.
• Ability to deliver engineering tasks as part of a collaborative team, troubleshoot technical issues, and work with operations, platform owners, and vendors through testing, deployment, and operational handover.
• Cybersecurity engineering experience in solution design, configuration, implementation, technical documentation, and validation of log coverage, data quality, platform health, and resilience.
• Knowledge of information security frameworks, control requirements, least-privilege access, change management, and audit evidence relevant to security logging and monitoring.
• Working knowledge of Linux and Windows systems, databases, networking protocols, and security infrastructure, including TCP/IP, HTTP/HTTPS, DNS, syslog, firewalls, proxies, and IDS/IPS.
• Proficiency in scripting and automation using Python, PowerShell, or Bash, including experience with REST APIs, JSON processing, regular expressions, and version control.
• Working knowledge of cloud security in GCP, Azure, or AWS, including shared responsibility, IAM, service accounts, encryption and key management, network controls, cloud audit logging, and secure integration of cloud telemetry with SIEM platforms.
• Familiarity with AI and generative AI tools for engineering automation, code assistance, log analysis, and documentation, including validation of generated outputs and use of approved tools with appropriate data protection and human review.
• Awareness of AI security risks and safeguards, including prompt injection, sensitive-data exposure, access controls, and logging and monitoring of AI-enabled services.

Nice To Haves

• Bachelor’s degree preferred and/or equivalent experience.
• Relevant security, cloud security, or SIEM platform certifications, such as CEH, CCSP, CISSP, OSCP, or cloud-provider security certifications.

Responsibilities

• Identify, assess, and document security logging and monitoring control gaps, and implement engineering solutions to address identified risks.
• Engineer coverage-monitoring and reconciliation capabilities to identify missing or unhealthy log sources, and partner with platform owners to investigate and remediate gaps.
• Design, implement, configure, and maintain SIEM platforms and ingestion components to collect and normalize security telemetry across on-premises and cloud environments.
• Onboard log sources by configuring collectors, connectors, and data feeds; developing or updating parsers; and validating end-to-end ingestion against agreed requirements.
• Develop and maintain data-quality checks for log completeness, timeliness, parsing accuracy, and required fields, and troubleshoot issues affecting telemetry usability.
• Implement and maintain Central Log Management infrastructure and pipelines for scalable, resilient collection, routing, storage, and retrieval of log and telemetry data.
• Tune ingestion pipelines, storage, search performance, and retention configurations to balance platform capacity, reliability, and cost with approved requirements.
• Maintain platform health and security through monitoring, troubleshooting, upgrades, patching, access-control configuration, and change management in line with organizational and regulatory requirements.
• Develop scripts, integrations, and automation to streamline log onboarding, coverage reconciliation, data-quality validation, and platform health monitoring.
• Support disaster recovery planning and exercises by validating recovery procedures, platform availability, and restoration of log ingestion.
• Support audits and regulatory assessments by providing technical evidence, documenting control configurations, and implementing assigned remediation actions.
• Collaborate with operations, security monitoring teams, infrastructure and application owners, and vendors to translate monitoring requirements into technical solutions and resolve integration issues.
• Maintain engineering designs, configuration records, implementation procedures, and support runbooks for consistent delivery and effective operational handover.
• Develop and maintain dashboards and technical metrics for ingestion health, coverage, data quality, and capacity, and communicate progress, risks, and dependencies to stakeholders.
• Investigate ingestion failures and platform issues, perform root-cause analysis, implement fixes within managed systems, and coordinate source-side remediation with accountable IT owners.
• Deliver assigned engineering tasks for platform implementations, migrations, and enhancements, including testing, deployment validation, and transition to operational support.
• Contribute to Cyber Observability Engineering standards, continuous improvement initiatives, and other assigned security observability responsibilities.

Benefits

• Competitive compensation, including base pay and annual incentive.
• Comprehensive health and life insurance and well-being benefits, based on location.
• Pension / Retirement benefits.
• Paid Time Off and Personal/Family Care, and other leaves of absence when needed to support physical, financial, and emotional well-being.
• Flexible/hybrid work model with three days onsite and two days remote.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior