SIEM Security Engineer

SIEM Security Engineer

Location: Toronto, Ontario – Hybrid (2 days onsite, 3 days remote)

Schedule: Monday–Friday, core business hours

Hours: 37.5 hours per week

Contract Duration: Through September 2027

Start Date: ASAP

Extension: Potential extension based on business needs and performance

Conversion: Potential for permanent employment based on business needs and performance

Rate: $40-53/h (INC)

About the Opportunity

We are seeking a Cybersecurity Engineer / Information Security Analyst with hands-on experience administering enterprise Security Information and Event Management (SIEM) platforms.

The ideal candidate will have experience working with SIEM products and log pipelines such as Splunk Enterprise, Microsoft Sentinel, Google SecOps, and Cribl.

This role focuses on hands-on system administration, Level 3 and Level 4 technical support, platform integration, and optimization initiatives supporting enterprise security logging and monitoring requirements.

You will play an important role in maintaining and enhancing SIEM platform design, architecture, and technical capabilities while ensuring alignment with industry best practices.

Key Responsibilities

• Integrate various data sources to capture system and application security events within enterprise SIEM platforms.
• Administer and maintain enterprise SIEM platforms, including system and application upgrades, health checks, dashboard development, and reporting.
• Collaborate with data onboarding teams and key stakeholders to ingest data into SIEM platforms for security use-case development, dashboards, and reporting.
• Support the strategic roadmap for analytics technologies in collaboration with security engineering and cyber threat management teams.
• Contribute to the ongoing development and optimization of enterprise SIEM platforms to meet business requirements.
• Research logging techniques to identify, retrieve, and monitor security events generated by emerging technologies.
• Provide advanced technical support and troubleshooting for enterprise security monitoring platforms.

Required Qualifications

• Post-secondary education is required.
• Minimum 2 years of cybersecurity analyst or cybersecurity engineering experience.
• Minimum 2 years of hands-on experience with Security Information and Event Management (SIEM) tools.
• Foundational certification in Splunk or Microsoft Security is required.

Nice-to-Have Qualifications

• Experience with Google SecOps or Cribl.
• Previous experience within the banking or financial services industry.
• Experience developing dashboards and reports using Microsoft Sentinel or Splunk.

Required Technical Skills

• Splunk Enterprise
• Microsoft Sentinel
• Enterprise SIEM administration
• Security logging and monitoring
• Log pipeline integration
• Security event management
• Dashboard development and reporting

Required Soft Skills

• Strong written and verbal communication skills.
• Excellent information-gathering and analytical abilities.
• Strong reporting and technical documentation skills.
• Excellent collaboration and interpersonal skills.
• Ability to work effectively within a team environment.
• Strong problem-solving and troubleshooting abilities.

Team & Work Environment

• Collaborative team environment consisting of approximately 15 team members.
• Primarily internal stakeholder interaction.
• Average of 1–2 hours of meetings per day.
• Onboarding and knowledge transfer provided.
• No direct customer data access required.
• No travel required.
• No overtime or rotational shifts expected.

Performance Expectations

Performance will be evaluated based on:

• Quality and accuracy of work.
• Ability to meet project delivery timelines.
• Active participation and contribution to project initiatives.
• Collaboration with team members and stakeholders.
• Overall technical contribution to security platform improvements.

Note: We use AI tools to: obtain basic information, detect plagiarism, false employment history or references, categorize your skills, and do an initial match with job posting.