Delivery Consultant (L2/IR) - Cyber SOC Engineer

About the role

As a SOC security engineer within the Risk Advisory practice, you will plan, build and continuously improve the enterprise security operations platform around SIEM platforms such as Splunk and ELK. You will handle log ingestion, detection engineering, security automation and platform operations to raise overall detection capability and operational efficiency.

Key responsibilities

• Deploy, configure and maintain Splunk Enterprise / ES and ELK platforms, including upgrades, performance tuning, capacity planning and high availability
• Manage components such as Heavy Forwarders, Indexers, Search Heads and Deployment Servers
• Ingest logs from network devices, servers, cloud platforms, endpoints, databases and applications, write parsing rules and standardise fields
• Build detection use cases, correlation searches, alert rules and risk models, reduce false positives and design detection based on MITRE ATT&CK
• Develop Python tools and integrate with SOAR, threat intelligence feeds and REST APIs for automated response, IOC enrichment and ticketing
• Monitor platform health, write runbooks, support threat hunting and incident response, and assist audits and compliance checks

Required profile

• Degree or above in cybersecurity, computer science or related field
• At least one year of experience in SOC, security platforms or SIEM
• Good communication and teamwork skills, strong problem-solving ability
• Preferred: Splunk ES project experience, ELK platform experience, detection engineering, threat hunting, SOAR or threat intelligence platform experience

Required skills

• SIEM: Splunk Enterprise, Splunk ES, ELK (Elasticsearch, Logstash, Kibana)
• OS: Linux, Windows Server
• Log collection: Syslog, Splunk Universal Forwarder, Fluent Bit, Filebeat, Winlogbeat
• Cloud: AWS, Microsoft Azure, Alibaba Cloud (CloudTrail, ActionTrail)
• Knowledge of Windows and Linux security logs, MITRE ATT&CK and SIEM detection logic
• Programming: Python, PowerShell, Bash; REST API experience