🎁 Before you apply, rehearse this interview. Create your free WorkMundi account and get an Interview Training on HelpsYouSpeak — no cost, no card. I want my training →
Senior SIEM and SOC Platform EngineerOverviewCyber Sigma is looking for a Senior SIEM and SOC Platform Engineer to design and build an enterprise-grade Security Information and Event Management and Security Operations platform. The candidate will be responsible for security-data ingestion, normalization, enrichment, detection engineering, correlation, alerting, investigation, orchestration, case management, dashboards and platform operations. The candidate should have the ability to create a product-oriented SIEM platform instead of only installing or administering an existing tool. Key ResponsibilitiesSIEM Platform ArchitectureDesign a scalable, multi-tenant SIEM architecture.Build log-collection, ingestion and processing pipelines.Develop secure agent and agentless data-collection mechanisms.Design hot, warm, cold and archive data-retention tiers.Implement high availability, fault tolerance and disaster recovery.Design secure tenant isolation and customer-specific workspaces.Establish role-based access for SOC analysts, customers and administrators.Develop platform-health, pipeline-health and data-quality monitoring.Optimize the platform for performance, storage and search efficiency.Log Collection and IntegrationDevelop integrations and parsers for: Windows systemsLinux systemsNetwork devicesFirewallsVPN systemsActive DirectoryIdentity and access-management platformsEndpoint-security productsCloud platformsEmail-security systemsWeb applicationsDatabasesContainers and KubernetesSaaS applicationsAPI gatewaysVulnerability scannersThreat-intelligence feedsCustom business applicationsDetection EngineeringCreate and maintain detection rules and correlation logic.Map detections to recognized attack techniques and tactics.Develop use cases for authentication, privilege abuse, lateral movement, malware, data exfiltration, cloud attacks and insider threats.Build behavioural baselines and anomaly-detection capabilities.Tune detection rules to reduce false positives.Establish detection testing and validation processes.Develop detection-as-code practices.Maintain use-case versioning and deployment pipelines.Measure coverage against threat scenarios.Develop organization-specific and industry-specific detection packs.SOC Workflow DevelopmentBuild alert-triage and investigation workflows.Develop incident and case-management functionality.Create analyst queues, severity models and escalation workflows.Develop automated playbooks and response workflows.Integrate threat intelligence, asset criticality and vulnerability data.Create investigation timelines and evidence records.Build SLA tracking and escalation mechanisms.Enable analyst collaboration and audit trails.Develop executive, SOC manager, analyst and customer dashboards.Advanced Platform CapabilitiesSecurity analytics and behavioural analysisUser and entity behaviour analyticsThreat-intelligence managementAutomated enrichmentSecurity orchestration and responseAttack-path analysisKnowledge-graph-based investigationAI-assisted alert triageAI-assisted incident summarizationNatural-language security searchPredictive risk analysisAutomated incident-report generationContinuous control monitoringCompliance-oriented log and evidence reportingRequired Technical SkillsLinux system administrationWindows security loggingNetwork and security protocolsLog-processing pipelinesSearch and analytics enginesMessage queues and streaming technologiesPython, Go, Java or a comparable programming languageRegular expressions and parser developmentSQL and NoSQL databasesREST APIs and webhooksContainerizationKubernetesCloud infrastructureInfrastructure as codeGit and CI/CDMonitoring and observabilitySecurity KnowledgeSOC operationsIncident responseThreat huntingDetection engineeringMalware and attack behaviourNetwork-security monitoringCloud-security monitoringEndpoint telemetryThreat intelligenceDigital forensics fundamentalsVulnerability managementIdentity-security monitoringSecurity automationRequired QualificationsBachelors or Masters degree in Computer Science, Cybersecurity, Engineering or a related discipline.Five to twelve years of experience in SIEM, SOC, detection engineering or security-platform development.Experience handling high-volume security data.Experience developing log parsers and correlation rules.Experience integrating multiple enterprise security products.Strong troubleshooting and performance-optimization skills.Ability to translate attack scenarios into monitoring and detection use cases.Preferred CertificationsCISSPGIAC certificationsCertified SOC AnalystCloud-security certificationKubernetes certificationVendor-neutral incident-response or threat-hunting certificationKey Performance IndicatorsNumber and quality of completed data-source integrations.Event ingestion success rate.Parser accuracy and data-normalization quality.Mean time to detect.Mean time to acknowledge.Mean time to respond.False-positive reduction.Detection coverage.Platform availability.Query .
Here's how to pick the right one and stand out in your application.
144.883Jobs
31.687IN
81%EN
That number is real. WorkMundi's database shows 144,883 open engineer roles across the world. India has the most with 31,687 jobs, followed by the United States with 30,084. If you just finished reading one job ad and felt paralyzed by choice, you're not alone—but this scale is actually an advantage. It means you can afford to be selective.
Start by geography and language. The majority of engineer ads—117,837 of them—have the job posting text written in English. Use that as one filter, but remember: the ad text language tells you nothing about whether the role actually requires you to speak English day-to-day. Read the job description carefully. Then check which countries have the volume you're targeting. Singapore, Poland, and Australia round out the top five after India and the US.
Next, learn who's hiring. Accenture has posted 2,801 engineer roles. andurilindustries, speechify, and jobgether are also actively recruiting. If you're applying to one of these names, research their hiring patterns and interview style before you apply. That homework pays off.
When you interview, expect the question every engineer hears: 'Tell me about a time you had to debug a problem that wasn't in your job description.' Have a specific story ready—not a general one. Name the tools, the deadline pressure, and what you learned. Hiring managers listen for whether you see problem-solving as part of the role itself, not a favour.