Senior Security Operations Engineer (SIEM / SOAR) (m/f/d)
Halian | Managed Services, Recruitment Agency & Contract Staffing
Role:Senior Security Operations Engineer (SIEM / SOAR)
Role Overview
We are seeking an experienced Senior Security Operations Engineer (SIEM / SOAR) to lead the design, implementation, and optimization of enterprise security monitoring and automation capabilities within a highly regulated environment.
This role will be responsible for engineering and managing Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) platforms while supporting enterprise-scale security monitoring, threat detection, and incident response initiatives. The successful candidate will play a critical role in enhancing security visibility, automating response workflows, and ensuring monitoring controls remain effective, resilient, and audit-ready.
The ideal candidate will possess strong expertise in IBM QRadar, Microsoft Sentinel, SIEM Engineering, SOAR Automation, Detection Engineering, Threat Monitoring, and Security Operations, with experience working in large-scale Security Operations Centers (SOC) and regulated environments. [
Key Responsibilities
SIEM Engineering & Platform Management
Design, implement, and maintain enterprise SIEM platforms including IBM QRadar and Microsoft Sentinel.
Manage log onboarding, parsing, normalization, and monitoring across infrastructure, cloud, identity, application, database, and endpoint environments.
Design scalable SIEM architectures, including data retention, workspace design, performance optimization, and capacity planning.
Monitor platform health and ensure continuous log collection visibility across all critical sources.
Manage SIEM upgrades, lifecycle management, platform maintenance, and optimization activities.
SIEM Modernization & Migration
Support or lead SIEM transformation and migration initiatives, including QRadar to Microsoft Sentinel migrations.
Translate existing detection content into modern cloud-native detection capabilities.
Ensure continuity of security monitoring, detection coverage, and historical log access during platform transitions.
Detection Engineering
Develop, tune, and maintain security detections aligned with threat intelligence and the MITRE ATT&CK framework.
Build and improve use cases focused on cyber threats impacting financial services and enterprise environments.
Continuously optimize detection logic to improve alert fidelity and reduce false positives.
SOAR & Automation
Design and implement security automation workflows and SOAR playbooks.
Automate enrichment, investigation, triage, containment, notification, and response activities.
Integrate SIEM and SOAR platforms with EDR, threat intelligence, identity platforms, and ITSM solutions.
Governance & Operational Support
Support SOC analysts and incident response teams during major security events.
Develop and maintain technical documentation, architecture diagrams, runbooks, and operational procedures.
Support audits, regulatory reviews, and compliance assessments with evidence of control effectiveness.
Track and report platform performance, coverage metrics, and operational effectiveness.
Required Skills & Qualifications
5-10 years of experience in Security Operations, SIEM Engineering, Detection Engineering, or Cybersecurity Operations.
Proven expertise in:
IBM QRadar
Microsoft Sentinel
SIEM Engineering
SOAR Automation
Detection Engineering
Security Monitoring
Strong hands-on experience with:
KQL (Kusto Query Language)
AQL
Microsoft Sentinel Analytics Rules
QRadar Rule Development
Log Parsing & Normalization
Experience with:
Syslog
CEF
APIs
Azure Monitor Agent (AMA)
Data Collection Rules (DCRs)
Strong understanding of:
MITRE ATT&CK
Threat Detection Methodologies
SOC Operations
Incident Response Processes
Experience working with:
Microsoft Defender XDR
Microsoft Entra ID
Azure Security Services
Scripting experience in:
PowerShell
Python
Excellent analytical, troubleshooting, and stakeholder management skills.
Preferred Skills & Experience
Experience delivering SIEM migrations, particularly QRadar to Microsoft Sentinel.
Banking or financial services industry experience.
Experience supporting 24x7 Security Operations Centres.
Knowledge of regulatory standards including PCI DSS and banking security frameworks.
Experience integrating threat intelligence and endpoint security platforms.
Familiarity with Infrastructure as Code (Terraform, ARM, Bicep).
Experience implementing CI/CD pipelines for detection content and security engineering.
Certifications
Preferred
Microsoft Certified: Security Operations Analyst Associate (SC-200)
IBM QRadar Certified Administrator
IBM QRadar Deployment Professional
CISSP
GIAC GCIA
GIAC GCIH
GIAC GCDA
Education & Qualifications
Bachelor's degree in Computer Science, Information Security, Engineering, or a related discipline.
Relevant certifications in SIEM, Security Operations, Cloud Security, or Cybersecurity Engineering are highly desirable.
Halian Group
With over 28 years of experience, we have come to understand that innovation is the only way to provide agile, practical solutions that transform businesses and careers. Our resourcing and smart services help you to realise tomorrow's potential. Discover the amazing things possible when you bring the right people and the right technologies together.
At Halian, we recognise that diversity, equity, and inclusion (DEI) are essential to building high-performing teams for our clients. We are committed to connecting organisations with top talent from all backgrounds, ensuring that every individual feels valued, respected, and empowered to contribute their unique perspectives.
We encourage applications from all qualified candidates, regardless of race, gender, disability, or any other characteristic that makes them unique.
Senior Security Operations Engineer (SIEM / SOAR) in Abu Dhabi, United Arab Emirates