SIEM/SOC Engineer

About the role

Teslm is building a central SIEM/SOC capability and needs a hands‑on engineer to own the entire pipeline—from log source onboarding to daily triage. You will work directly with the CEO and CISO, designing, implementing and maintaining the security monitoring stack for our AWS environment and applications.

Key responsibilities

• Own log‑source onboarding: CloudTrail, GuardDuty, Security Hub findings, infrastructure logs and application security events, parsing each into a common schema.
• Develop, version and tune a focused set of high‑value detection rules aligned with top risks, reviewing false positives weekly.
• Monitor health of every log source, identifying gaps before auditors or attackers notice.
• Run daily triage and containment: investigate events by host, user and IP, obtain a second review before any production action, and document each case.
• Maintain immutable log archive and retention policies that satisfy PCI DSS v4, PDPL, NCA ECC‑2:2024 and ISO/IEC 27001 requirements.
• Create and maintain runbooks, saved queries and escalation paths for the L1 SOC Analyst, setting daily priorities.

Required profile

• 2–4 years of hands‑on SIEM/SOC experience, personally onboarding log sources, writing/tuning detections and triaging alerts.
• Built or maintained a SIEM solution (e.g., Wazuh, Elastic, Splunk, CrowdStrike) and can explain design choices.
• Working knowledge of AWS security logging (CloudTrail, GuardDuty, Security Hub) and how events flow into a SIEM.
• Comfortable with log parsing, normalisation, query languages and Linux administration for the components you run.
• Ability to write clear runbooks and incident documentation.
• Hands‑on practitioner mindset; not a pure architect or leadership role.

Required skills

• SIEM platforms: Wazuh, Elastic, Splunk, CrowdStrike
• AWS security services: CloudTrail, GuardDuty, Security Hub
• Log parsing and normalisation
• Query languages (e.g., Elasticsearch DSL, SPL)
• Linux system administration