Principal Cyber Security Engineer
Work Schedule
Work Schedule: Ally designates roles as (1) fully on-site, (2) hybrid, or (3) fully remote. Hybrid roles are generally expected to be in the office a certain number of days per week as indicated by your manager. Your hiring manager will discuss this role's specific work requirements with you during the hiring process. All work requirements are subject to change at any time based on leader discretion and/or business need.
About the Role
We are seeking a Principal Cyber Security Engineer with hands-on experience designing, deploying, and optimizing SIEM (Security Incident & Event Management) platforms at scale. The individual will own the end-to-end lifecycle of SIEM capability—from architecture and data onboarding to content engineering, automation, and continuous improvement. The individual will collaborate with SOC analysts, incident responders, threat hunters, IT operations, and application teams to ensure high-fidelity detections, actionable visibility, and reliable, compliant log management.
Responsibilities
- Design and maintain the SIEM architecture, including data ingestion pipelines, parsers, normalization schemas, storage tiers, and retention strategies.
- Evaluate and implement SIEM platform features and integrations; drive upgrades and migrations as needed.