Principal Security Consultant - SIEM (City of London)

Role

• Lead the design, deployment and tuning of enterprise-grade SIEM platforms (e.g. Splunk, Azure Sentinel etc.)
• Collaborate with stakeholders to define logging requirements, use cases, detection rules and dashboards
• Oversee integration of data sources from cloud, on-prem, endpoint, network and application layers
• Create and maintain detection rules, correlation logic and alerts tailored to specific threat scenarios
• Provide technical leadership and mentorship to team members
• Work closely with SOC teams to align SIEM capabilities with business objectives
• Conduct SIEM health checks, performance tuning and capacity planning

Skills

• Expertise in SIEM design, deployment and optimisation
• Hands-on expertise with one or more major SIEM platforms (e.g. Splunk, Sentinel etc.)
• Deep understanding of log ingestion, parsing, normalisation and enrichment
• Strong grasp of MITRE ATT&CK framework, threat detection and alert logic
• Solid scripting/automation skills (e.g., Python, PowerShell, Bash)
• Experience with cloud logging and monitoring (AWS CloudTrail, Azure Monitor, GCP etc.)
• Experience with threat modelling, cloud security or Identity and Access Management is desirable