SIEM/SOAR Engineer

About the role

Own SIEM/SOAR pipelines: data onboarding, normalization/parsing, detection content, runbooks, automation, and role-based dashboards that give the SOC real-time visibility and consistent response.

Responsibilities

• Architect ingestion/normalization; maintain log source catalog and data quality controls.
• Create/tune correlation rules and SOAR playbooks aligned to ATT&CK; track coverage/efficacy.
• Integrate identity, endpoint, cloud, DLP, PAM, and threat intel; enforce RBAC and change governance.
• Deliver dashboards and KPIs; optimize reliability using SLOs/metrics.

Requirements

• 3-5 years with SIEM/SOAR (Splunk/Sentinel/etc.); KQL/SPL/Python; API integration.
• Experience with enrichment, UEBA, automation, and content lifecycle.
• Security clearance: Ability to obtain/maintain a Public Trust (or higher per client).
• US Citizenship or Green Card Required, with eligibility to obtain a public trust clearance.

Qualifications

• Bachelor's; vendor SIEM/SOAR certs a plus.

Skills

• SIEM/SOAR (Splunk/Sentinel/etc.)
• KQL/SPL/Python
• API integration
• Enrichment, UEBA, automation, and content lifecycle

Benefits

• Competitive compensation
• Comprehensive insurance options
• Matching contributions through the 401(k) plan and the share purchase plan
• Paid time off for vacation, holidays, and sick time
• Paid parental leave
• Learning opportunities and tuition assistance
• Wellness and Well-being programs

Pay

A reasonable estimate of the current range for this role in the U.S. is $63,700.00 - $139,300.00

Schedule

This position is located in our Knoxville, TN office; however, a hybrid working model is acceptable.