Senior SIEM Engineer

DTCC • Tampa, FL

2d • Hybrid

About The Position

The Senior SIEM Engineer is a member of DTCC’s CISO team and reports to the Associate Director, Cyber Threat Defense and Controls, within the Cybersecurity Engineering & Operations team. The role makes day-to-day decisions and implements the SIEM roadmap across security logging and monitoring, logging platforms, database activity monitoring, behavior analytics, security orchestration (SOAR), intrusion detection and prevention systems, and incident response capabilities.

The position engineers and maintains SIEM and Central Log Management platforms and pipelines across on-premises and cloud environments. It supports reliable collection, normalization, quality, coverage, resilience, and retrieval of security telemetry, and contributes to platform implementations, migrations, enhancements, operational support, audits, and continuous improvement. The role collaborates with security monitoring, operations, infrastructure and application owners, and vendors to turn monitoring requirements into technical solutions and resolve issues.

DTCC’s Information Technology group provides secure, reliable technology solutions for the global capital markets. The Cybersecurity Services domain focuses on protecting DTCC from cybersecurity risks, while Cybersecurity Engineering provides enterprise security services.

Requirements

• Minimum of 6 years of related experience.
• Hands-on experience engineering SIEM and Central Log Management platforms, including collectors, connectors, ingestion pipelines, parsers, normalization, and security telemetry integration.
• Ability to deliver engineering tasks collaboratively, troubleshoot technical issues, and work with operations, platform owners, and vendors through testing, deployment, and operational handover.
• Cybersecurity engineering experience in solution design, configuration, implementation, technical documentation, and validation of log coverage, data quality, platform health, and resilience.
• Knowledge of information security frameworks, control requirements, least-privilege access, change management, and audit evidence relevant to security logging and monitoring.
• Working knowledge of Linux and Windows systems, databases, networking protocols, and security infrastructure, including TCP/IP, HTTP/HTTPS, DNS, syslog, firewalls, proxies, and IDS/IPS.
• Proficiency in Python, PowerShell, or Bash scripting and automation, with experience integrating REST APIs, processing JSON, using regular expressions, and maintaining code in version control.
• Working knowledge of cloud security in GCP, Azure, or AWS, including shared responsibility, IAM, service accounts, encryption and key management, network controls, cloud audit logging, and secure integration of cloud telemetry with SIEM platforms.
• Familiarity with AI and generative AI tools for engineering automation, code assistance, log analysis, and documentation, including validation of generated outputs and use of approved tools with appropriate data protection and human review.
• Awareness of AI security risks and safeguards, including prompt injection, sensitive-data exposure, access controls, and logging and monitoring of AI-enabled services.

Nice To Haves

• Bachelor’s degree preferred and/or equivalent experience.
• Relevant security, cloud security, or SIEM platform certifications, such as CEH, CCSP, CISSP, OSCP, or cloud-provider security certifications.

Responsibilities

• Identify, assess, and document security logging and monitoring control gaps, and implement engineering solutions to address identified risks.
• Engineer coverage-monitoring and reconciliation capabilities to identify missing or unhealthy log sources, and partner with platform owners to investigate and remediate gaps.
• Design, implement, configure, and maintain SIEM platforms and ingestion components for reliable collection and normalization of security telemetry across on-premises and cloud environments.
• Onboard log sources by configuring collectors, connectors, and data feeds; developing or updating parsers; and validating end-to-end ingestion against agreed requirements.
• Develop and maintain data-quality checks for log completeness, timeliness, parsing accuracy, and required fields, and troubleshoot issues affecting telemetry usability.
• Implement and maintain Central Log Management infrastructure and pipelines for scalable, resilient collection, routing, storage, and retrieval of log and telemetry data.
• Tune ingestion pipelines, storage, search performance, and retention configurations to balance platform capacity, reliability, and cost with approved requirements.
• Maintain platform health and security through monitoring, troubleshooting, upgrades, patching, access-control configuration, and change management in line with organizational and regulatory requirements.
• Develop scripts, integrations, and automation for log onboarding, coverage reconciliation, data-quality validation, and platform health monitoring.
• Support disaster recovery planning and exercises by validating recovery procedures, platform availability, and restoration of log ingestion.
• Support audits and regulatory assessments by providing technical evidence, documenting control configurations, and implementing assigned remediation actions.
• Collaborate with operations, security monitoring teams, infrastructure and application owners, and vendors to translate monitoring requirements into technical solutions and resolve integration issues.
• Maintain engineering designs, configuration records, implementation procedures, and support runbooks for consistent delivery and operational handover.
• Develop and maintain dashboards and technical metrics for ingestion health, coverage, data quality, and capacity, and communicate engineering progress, risks, and dependencies to stakeholders.
• Investigate ingestion failures and platform issues, perform root-cause analysis, fix issues within Cyber Observability Engineering’s managed systems, and coordinate source-side remediation with accountable IT owners.
• Deliver assigned engineering tasks for platform implementations, migrations, and enhancements, including testing, deployment validation, and transition to operational support.
• Contribute to Cyber Observability Engineering standards, continuous improvement initiatives, and other assigned security observability responsibilities.

Benefits

• Competitive compensation, including base pay and annual incentive.
• Comprehensive health and life insurance and well-being benefits, based on location.
• Pension / Retirement benefits.
• Paid Time Off and Personal/Family Care, and other leaves of absence when needed to support physical, financial, and emotional well-being.
• Flexible/hybrid work model with 3 days onsite and 2 days remote.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior