SIEM & Detection Engineer - Wazuh | Azure | SOC

Role Description
Wazuh / SIEM administration and engineering
Log source onboarding & integration across Windows, Linux, Azure, Kubernetes, firewalls, WAF, EDR/XDR, VPN, DNS, applications and databases
Detection engineering – rules, decoders, parsers, correlation and security use cases
SIEM alert tuning and false-positive reduction
Detection development aligned with MITRE ATT&CK
Azure and Kubernetes security monitoring
SIEM integration with SOAR, EDR, Threat Intelligence and ticketing platforms
Threat hunting and proactive detection improvement
SIEM troubleshooting, log-ingestion health and data-quality management
Supporting SOC analysts with investigation and incident response
Building and maintaining dashboards, KPIs, runbooks and detection documentation
Qualifications
4–6 years of hands-on experience in SIEM Esp Wazuh, SOC, cybersecurity engineering, or security monitoring.
Experience working in an MSSP/SOC environment, supporting multiple customers, tenants, or security monitoring environments.
Strong hands-on experience with Wazuh or equivalent SIEM platforms.
Experience with multi-tenant SIEM operations, customer-specific log onboarding, detection use cases, alert tuning, and monitoring requirements.
Experience onboarding and integrating logs from Windows, Linux, Azure, Kubernetes, firewalls, WAF, EDR/XDR, VPN, IAM/Entra ID, DNS, applications, and databases.
Strong understanding of SIEM architecture, log collection, parsing, normalization, correlation, detection rules, and alerting.
Experience developing, maintaining, and tuning SIEM use cases and detection rules.
Good understanding of MITRE ATT&CK, threat detection, threat hunting, and common attack techniques.
Good knowledge of Microsoft Azure and Azure security/logging services.
Hands-on understanding of Kubernetes and container environments.
Strong knowledge of Windows, Linux, networking, and security technologies.
Experience integrating SIEM with SOAR, EDR/XDR, Threat Intelligence, ticketing, and other security platforms.
Ability to troubleshoot log ingestion, agents, collectors, parsers, indexing, storage, and SIEM performance.
Strong analytical, troubleshooting, documentation, and communication skills.
Ability to work with SOC L1/L2 analysts, customers, DevOps, infrastructure, and security teams.

Work arrangement
No