Cyber Defense Engineer - SIEM
NorthMark Strategies · New York, NY · 2 wk ago
Information TechnologyFull-time
Responsibilities
- Design, develop, and deploy AI-enhanced detections and automations within the SIEM/SOAR platform to improve signal-to-noise ratio and reduce alert fatigue.
- Engineer and optimize SIEM pipelines using AI/ML techniques for anomaly detection, behavioral analytics, and threat correlation.
- Integrate SIEM with security tools and data sources to build a context-rich, intelligence-driven monitoring ecosystem.
- Develop and implement AI-assisted threat detection models, including user/entity behavior analytics (UEBA) and predictive analytics.
- Collaborate with cyber defense operations to identify emerging threats and capability gaps, leveraging AI to proactively strengthen defenses.
- Build and maintain automated response orchestration and intelligent playbooks that adapt based on threat context.
- Partner with IT and engineering teams to ensure comprehensive telemetry collection and high-quality data pipelines.
- Continuously improve SIEM engineering practices, including data normalization, enrichment strategies, and AI model tuning.
- Support SOC operations by enhancing detection engineering, incident response workflows, and operational metrics through AI augmentation.
Requirements
- Bachelor’s degree in computer science, Information Security, or a related field.
- 4–6+ years of experience in cybersecurity engineering, SOC engineering, or insider threat.
- Demonstrated expertise in SIEM engineering and security monitoring at scale.
- Experience integrating or developing AI/ML capabilities within security operations or detection engineering.
- Strong understanding of the Microsoft security stack (e.g., Sentinel, Defender suite).
- Proficiency with automation tooling and scripting languages (KQL, Python, Powershell).
- Proficiency in API development with the goal of integrating security tooling.
- Familiarity with various log ingestion methodologies into a SIEM environment.
- Experience in multi-tenant or MSP like environments a plus.
- Highly motivated self-starter who thrives on positively influencing the environment.