Senior Information Security Engineer – SIEM and Detection

We need to output HTML fragment with sections: About the role? The posting includes intro paragraphs about firm, then "Job Description Summary", "Job Description", "What you would do", "What Is Expected", "What We Offer", "What Is Required". We need to use

for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must not repeat job title as heading. We need to map content to appropriate sections. We need to decide which sections to include based on content. We have: - About the role: could be the introductory summary: "Faegre Drinker has an opportunity for a Senior Information Security Engineer – SIEM and Detection to work with our Technology & Innovation team in our Philadelphia, New York City, or Washington, D.C. offices. You will be part of a dynamic team responsible for owning the firm’s security monitoring platform and the detection capability built on it." That's a description of role. - Responsibilities: the "What you would do:" list. - Requirements/Qualifications/Skills: The "What Is Required" list includes education, experience, specific skills. Could split into Requirements (education, years experience) and Qualifications/Skills (specific technical skills). But we can combine into one Requirements section if we want few substantive sections. However we need to follow instruction: Prefer a few substantive sections over many thin ones. So we could have sections: About the role, Responsibilities, Requirements, Benefits, Pay. Possibly also "What Is Expected" could be considered Skills/Competencies (soft skills). Could merge into Requirements or a separate Skills section. We have Pay: salary range given. We have Benefits: "What We Offer" list includes flexible working environment, volunteer events, wellness programming, professional environment, health plan options, dental, vision, 401(k), generous paid time off. Also mention discretionary bonus, insurance etc in salary description. We have Schedule: not explicitly mentioned; maybe hybrid work environment mentioned earlier: "With technology tools and resources that support our hybrid work environment". Could be considered schedule? But schedule not given; we should not create Schedule section unless posting actually states them. It mentions hybrid work environment, but not specific schedule. Might be considered a benefit? Probably not enough to create Schedule section. We must not include boilerplate like EEO, E-Verify, etc. We must not include application instructions like "Apply now if you are ready..." etc. We must preserve all substantive information; do not invent or summarize away detail. We need to output only HTML fragment, no /, no markdown fences. We'll produce something like:

About the role

Faegre Drinker has an opportunity for a Senior Information Security Engineer – SIEM and Detection to work with our Technology & Innovation team in our Philadelphia, New York City, or Washington, D.C. offices. You will be part of a dynamic team responsible for owning the firm’s security monitoring platform and the detection capability built on it.

Responsibilities

• Owns the architecture, configuration, health, and performance of the firm’s SIEM platform, including data ingestion, parsing, normalization, retention, and cost management, in partnership with CrowdStrike as the managed security service provider
• Onboards and maintains log sources across Microsoft Defender, Microsoft Entra ID, Microsoft 365, Microsoft Purview, Azure, CrowdStrike, network and firewall infrastructure, and key business applications, using Event Hub, Graph API, and native connectors as appropriate
• Designs, builds, tests, and tunes detection rules and analytics mapped to the MITRE ATT&CK framework, prioritizing coverage based on the firm’s threat profile and risk
• Serves as senior technical lead for the Security Incident Response Team, guiding investigations from analysis and containment through recovery and reporting, and advising the Director and leadership on response decisions
• Owns the firm’s Incident Response Plan and playbooks, maintaining them as the firm’s environment, threats, and regulatory obligations evolve
• Owns the configuration of the CrowdStrike Falcon platform and its related modules across all firm endpoints and identities, including EDR, Identity Protection, Data Protection, prevention and update policies, integrations, and day-to-day tuning, along with adjacent security technologies that feed or act on Falcon data
• Builds security automation and orchestration workflows for common response actions, enrichment, and case management, integrating the SIEM, CrowdStrike, and ServiceNow
• Special projects and other duties as assigned

Requirements

• Bachelor’s degree in cybersecurity, information systems, or a related field, or equivalent years of experience
• Eight years or more of relevant information security experience, including security operations and incident response in an enterprise environment
• Hands-on experience engineering a SIEM platform, including log source onboarding, forwarding infrastructure, parsing and normalization, and at least one major deployment or migration
• Experience developing and tuning detections, with working knowledge of the MITRE ATT&CK framework and query languages such as KQL or equivalent
• Experience owning the configuration of an enterprise EDR platform, including policy management, tuning, integrations, and containment actions. CrowdStrike Falcon experience strongly preferred
• Demonstrated experience leading incident response, including building or maintaining incident response plans and playbooks and running tabletop exercises
• Experience managing a managed detection and response or managed security service provider relationship as the primary technical counterpart, including tuning, escalation, and service reviews
• Working knowledge of Microsoft security tooling, including Microsoft Defender, Microsoft Entra ID, Microsoft 365, and Microsoft Purview
• Working knowledge of network security, firewalls, and email security controls
• Thorough understanding of current security principles, techniques, and protocols
• Ability to effectively communicate information security issues, risks, and recommendations to both technical and non-technical peers and management, including through well-written reports

We could also include a Skills section for soft skills from "What Is Expected". But we could incorporate those into Requirements as they are also requirements. However we already have communication ability in Requirements list (last item). The "What Is Expected" includes problem solving, interpersonal, communication, concentration, judgment, flexibility, relationships, discretion, supervision, independent work, prioritize, detail-oriented, urgency, teamwork. Many of these are soft skills. We could add them to Requirements as additional bullet points. But we must not invent or summarize away detail; we need to preserve all substantive information. So we should include those as well. Thus we can extend Requirements list with those items. Alternatively we could create a separate "Skills" section for soft skills. But we prefer few sections; we could add them to Requirements. Let's list them: - Ability to problem-solve - Excellent interpersonal, verbal and written communication skills, including the ability to communicate effectively in a virtual environment (e.g., via phone, web/videoconference) - Ability to concentrate on tasks, make decisions and work calmly and effectively in a high-pressure, deadline-orientated environment - Demonstrated ability to use good judgment in taking initiative while asking for direction or clarification and consulting others, as appropriate - Willingness to be flexible with time and adjust to a changing work environment - Ability to build and maintain positive relationships, both internally and externally, while maintaining a client service orientation - Ability to use sound judgment and discretion in dealing with highly confidential information - Ability to take direction and accept supervision - Demonstrated ability to work independently, organize and accurately prioritize work, be detail-oriented, understand when urgency is required and use good judgment in varied situations - Ability to work effectively with co-workers in a team oriented collaborative environment We already have communication ability covered; but we can keep both. We must avoid duplication: we already have "Ability to effectively communicate information security issues, risks, and recommendations to both technical and non-technical peers and management, including through well-written reports". That's a specific communication skill. The "What Is Expected" includes more general communication skills. We can keep both as separate bullets; it's okay. Now Benefits section:

Benefits

• Flexible working environment for work-life success
• Opportunity to participate in firm-sponsored volunteer events
• Wellness programming with personalized content and activities
• Professional environment and the opportunity to work with experts at the top of their fields
• Variety of health plan options, as well as dental, vision and 401(k) plans
• Generous paid time off
• Discretionary bonus; life, health, accident, and disability insurance

We need to ensure we captured all benefits: The text also mentions "competitive benefits and rewards programs" earlier, but we have captured specifics. Pay section:

Pay

The anticipated initial salary for someone who is hired into this position is $160,200 - $183,100. Actual initial salary may be above or below the above-identified range and will be based on the relevant skills, training, experience, and other job-related factors, including the location where the position is filled, in all cases consistent with applicable law. This is an exempt role and the initial salary range listed above is just one component of Faegre Drinker's total compensation and benefits package for professional staff, which includes, but is not limited to, a discretionary bonus; life, health, accident, and disability insurance; and a 401(k) plan.

We should not repeat the bonus etc if already in Benefits; but it's okay to mention as part of total compensation. We must not include Schedule section because not explicitly stated. We must not include any boilerplate like EEO, E-Verify, etc. We must not include "Apply now..." etc. Now ensure we didn't miss any substantive info: The intro paragraph about firm being designed for clients and designed for you, etc. That's generic marketing; maybe we can include as part of About the role? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." The introductory sentences about firm being designed for clients and designed for you, commitment to investing in paraprofessional, administrative and operations professionals, looking for talented individuals, flexible high-performing culture, technology tools supporting hybrid work environment, culture of learning, support for work and personal goals, opportunities to give back, competitive benefits and rewards programs, opportunity to share expertise within and across teams, contribute to success. That's substantive but maybe considered boilerplate? It's not standard legal boilerplate; it's describing firm culture. Could be considered part of About the role or Benefits. We could incorporate into About the role or Benefits. Since we already have About the role short paragraph, we could expand it to include those culture statements. However we must not invent or summarize away detail; we can include them as part of About the role. Thus About the role could be a paragraph combining the firm description and the role summary. Let's craft:

Faegre Drinker is a firm designed for clients and designed for you. We understand that our people are critical to our success and we are committed to investing in our paraprofessional, administrative and operations professionals. We are always looking for talented, service-focused individuals to join our flexible and high-performing culture. With technology tools and resources that support our hybrid work environment, our colleagues enjoy a culture of learning, support for work and personal goals, opportunities to give back to our communities, and competitive benefits and rewards programs. At Faegre Drinker, you will have the opportunity to share your expertise within and across teams and contribute to our success. Faegre Drinker has an opportunity for a Senior Information Security Engineer – SIEM and Detection to work with our Technology & Innovation team in our Philadelphia, New York City, or Washington, D.C. offices. You will be part of a dynamic team responsible for owning the firm’s security monitoring platform and