SIEM Engineer / Security Platform Engineer (MD, Annapolis Junction )

Design, implement, configure, and maintain SIEM platforms (e.g., Splunk, Microsoft Sentinel, QRadar, Elastic).

Manage SIEM architecture, including data pipelines, storage, and system integrations.

Ensure platform availability, scalability, and resilience.

Log Integration & Data Pipeline Management

Integrate and onboard log sources including firewalls, servers, endpoints, SaaS applications, cloud platforms, and identity systems.

Build and maintain log ingestion pipelines to support real-time and batch data processing.

Ensure proper log normalization, parsing, and enrichment for accurate analysis.

Develop and maintain correlation rules, detection logic, and alerting mechanisms.

Collaborate with SOC analysts to improve detection use cases and reduce false positives.

Align detection logic with frameworks such as MITRE ATT&CK.

Monitor and optimize SIEM system performance, including query efficiency and ingestion rates.

Manage storage capacity and data lifecycle, including retention policies and archival strategies.

Identify and resolve performance bottlenecks.