Security Information and Event Management Detection Engineer

Information Security Management ensures the security and protection of Health Shared Services (HSS) information through monitoring, consulting, advisory services, and direct security support across the organization. The SIEM Detection Engineer helps identify, assess, and communicate security risks to HSS leadership and IT teams. The role influences security and operational priorities by advising on security technologies, controls, and best practices; evaluating risks related to software, hardware, and processes; and operating technical solutions used to monitor and protect systems. This position serves as the owner of several critical Security Operations monitoring technologies and processes, ensuring their effectiveness and ongoing improvement. The role may also support Human Resources investigations by collecting, analyzing, and reporting digital evidence. As part of normal security operations, the incumbent may be exposed to information that could lead to HR investigations or disciplinary action.

Manage and optimize SIEM operations, data integrations, and monitoring coverage to maintain effective security visibility. Design, implement, and maintain MITRE ATT&CK-aligned detections, analytics, and correlation rules. Develop dashboards, reports, queries, workbooks, and automation playbooks to improve threat detection, response, and operational efficiency. Continuously enhance detection effectiveness through tuning, threat validation, threat intelligence integration, and alert optimization. Lead the implementation and improvement of SIEM integrations, analytics, automation, and monitoring capabilities. Provide subject matter expertise to IT, corporate, clinical teams, projects, and stakeholders on security standards, technologies, and best practices. Support incident investigations, root cause analysis, remediation activities, and threat-hunting initiatives. Provide technical leadership and guidance for security-related operational and project activities. Assess the security landscape and recommend improvements to monitoring capabilities, tools, processes, configurations, and detection strategies. Advise on the use of SIEM and related security technologies to strengthen detection, investigation, and response capabilities across HSS. Administration and Special Assignments: Identify gaps in security monitoring technologies, processes, and practices, and support the design and implementation of detective and preventive controls. Contribute to the development and enhancement of organizational security capabilities through continuous improvement initiatives. Perform specialized assignments requiring advanced expertise, including areas such as digital forensics, software security, database security, and other security disciplines as required.