Senior Cyber Security Engineer - SIEM and Automation

About the role

We are seeking a highly skilled Senior Cyber Security Engineer - SIEM and Automation to lead and enhance our detection engineering capabilities. This role is responsible for developing high-fidelity use cases, optimizing logging strategies, integrating security tools, and tuning alerts to improve signal-to-noise ratio. You will work closely with Security Operations, Threat Intelligence, and Engineering teams to ensure our SIEM platform delivers actionable insights and supports rapid incident detection and response.

Responsibilities

• Use Case Development
• Design, develop, and maintain SIEM detection use cases aligned with MITRE ATT&CK and threat intelligence
• Translate threat scenarios into actionable detection logic and correlation rules
• Continuously improve detection coverage through gap analysis and adversary simulation insights
• Logging & Data Analysis
• Define and implement logging requirements across cloud, endpoint, network, and application layers
• Analyze log sources to ensure data quality, normalization, and completeness
• Identify gaps in telemetry and recommend improvements to enhance visibility
• Tool Integration & Data Onboarding
• Integrate new data sources into the SIEM (e.g., EDR, IAM, firewall, SaaS platforms)
• Work with engineering teams to onboard logs using APIs, agents, and log pipelines
• Ensure proper parsing, enrichment, and normalization of ingested data
• Alert Tuning & Optimization
• Reduce false positives through continuous alert tuning and threshold optimization
• Implement risk-based alerting and prioritization strategies
• Collaborate with SOC analysts to refine detection logic based on incident feedback
• SIEM Platform Engineering
• Maintain and optimize SIEM performance, scalability, and cost efficiency
• Develop dashboards, reports, and visualizations for operational and leadership insights
• Support automation and orchestration efforts with SOAR integrations where applicable
• Collaboration & Continuous Improvement
• Partner with Threat Intelligence to operationalize indicators and emerging threats
• Support incident response investigations with log analysis and detection enhancements
• Stay current with evolving attack techniques and detection methodologies

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, or related field (or equivalent experience)
• 3–7+ years of experience in SIEM engineering, detection engineering, or security operations
• Hands-on experience with SIEM platforms (e.g., Splunk, Microsoft Sentinel, QRadar, Elastic)
• Strong understanding of log sources (Windows, Linux, cloud platforms, network devices)
• Experience with query languages (e.g., SPL, KQL, Lucene, SQL)
• Knowledge of MITRE ATT&CK framework and adversary tactics/techniques
• Experience onboarding and parsing diverse data sources
• Preferred Qualifications:
• Experience with SOAR platforms and security automation
• Familiarity with cloud environments (AWS, Azure, GCP) and their native logging tools
• Scripting or programming skills (Python, PowerShell, etc.)
• Experience with detection-as-code and version control practices
• Security certifications (e.g., GCIA, GCIH, CISSP, Splunk Certified, Microsoft SC-200)

Skills

• Strong analytical and problem-solving skills
• Effective communication and collaboration across technical teams
• Continuous learning mindset with a focus on threat-driven defense

Benefits

• Compensation Range: $168,000 to $195,000 at the commencement of employment for the Jersey City, NJ and Woodland Hills, CA area
• Retirement Savings: Competitive 401(k) Plan with dollar-for-dollar Company matching contribution of up to 6% of eligible pay and a Company contribution equal to 3% of eligible pay (subject to annual IRS limits and Plan terms)
• Employee Assistance Program: Confidential counseling services and resources are available to all employees
• Matching charitable donations: Corebridge matches donations to tax-exempt organizations 1:1, up to $5,000
• Paid Time Off: Eligible employees start off with at least 24 Paid Time Off (PTO) days so they can take time off for themselves and their families when they need it
• Health and Wellness: We offer a range of medical, dental and vision insurance plans, as well as mental health support and wellness initiatives to promote overall well-being
• Volunteer Time Off: Employees may use up to 16 volunteer hours annually to support activities that enhance and serve communities where employees live and work

Work Location

This position is based in Corebridge Financial’s Woodland Hills, CA, Jersey City, NJ, or Houston, TX office and is subject to our hybrid working policy, which gives colleagues the benefits of working both in an office and remotely.

Estimated Travel

May include up to 25%.

Why Corebridge?

At Corebridge Financial, we prioritize the health, well-being, and work-life balance of our employees. Our comprehensive benefits and wellness program is designed to support employees both personally and professionally, ensuring that they have the resources and flexibility needed to thrive.

Equal Opportunity Employer

We are an Equal Opportunity Employer and committed to being an equal opportunity employer and we comply with all applicable federal, state, and local fair employment laws. All applicants will be considered for employment based on job-related qualifications and without regard to race, color, religion, sex, gender, gender identity or expression, sexual orientation, national origin, disability, neurodivergence, age, veteran status, or any other protected characteristic.