Join EY and contribute to building a better working world. As a Senior NG SIEM role, you will be at the forefront of ingestion engineering, detection creation, and integrated case management. This position offers a unique opportunity to partner with threat intelligence, cloud security, and incident response teams to enhance automation, minimize false positives, and strengthen our SIEM-SOAR ecosystem. Be a part of a globally connected organization committed to shaping your future with confidence.

Lead the onboarding of critical log sources using Cribl, cloud collectors, and API pipelines. Develop and refine parsing, normalization, and enrichment logic to ensure data accuracy and usability. Craft sophisticated detections aligned with MITRE ATT&CK frameworks using SPL, KQL, and CQL. Design and optimize correlation logic with Fusion and ML-based engines, and lead tuning efforts for correlation rules. Oversee the complete case lifecycle, including triage workflows, enrichments, severity determination, and SLA adherence. Develop and maintain SOAR playbooks for automated tasks such as enrichment, notifications, and containment. Integrate external security systems into SOAR workflows and conduct root-cause analysis for any gaps in ingestion or correlation. Collaborate closely with Threat Intelligence and Detection teams to implement new use cases and leverage AI assistants like Charlotte AI and Sentinel Copilot to accelerate detection creation and investigation processes.

This senior role requires 3–6 years of dedicated experience in SIEM engineering or SOC detection. You should possess strong, hands-on experience with correlation engines such as Fusion (CrowdStrike), Azure Sentinel Analytics, or Splunk ES Correlation Searches. Proficiency in creating and maintaining SOAR playbooks, including Fusion workflows, Sentinel Logic Apps, or Splunk SOAR, is essential. A deep understanding of case management workflows and alert lifecycle governance is expected. Expertise in ingestion engineering with Cribl Stream & Lake, along with mastery of query languages like SPL, KQL, and CQL, is crucial. A solid understanding of data models, schemas, and threat modelling principles is also required.