{"id":3526770,"url":"https://alion.io/job/andersen-siem-administrator-engineer","title":"SIEM Administrator / Engineer","company":{"id":8912,"name":"Andersen","domain":"andersenlab.com","url":"https://alion.io/company/andersen-lab","size_band":null,"is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"HeadHunter","truth_index":{"grade":"A","score":86,"open_postings":11,"ghost_share":0.091,"stale_share":0,"repost_share":0.545,"time_to_fill_p50_days":30,"computed_at":"2026-11-03T05:54:40Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Warsaw, Poland","Kraków, Poland","Vilnius, Lithuania","Munich, Germany","Poland"],"countries":["PL","LT","DE"],"hiring_countries":["PL"],"hiring_countries_total":1,"salary":{"min":14400,"max":28400,"currency":"PLN","period":"month","gross":null,"usd_annual":86748},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Elastic SIEM","optional":false},{"name":"IBM QRadar","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Windows","optional":false},{"name":"AWS","optional":true},{"name":"Cortex","optional":true},{"name":"Cortex XSOAR","optional":true},{"name":"Git","optional":true},{"name":"PowerShell","optional":true},{"name":"Prometheus","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-10-30T12:14:11Z","employer_posted_date":null,"last_verified_at":"2026-10-30T12:14:11Z","board_verified":false,"closed_at":null,"days_open":3,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":3},"description":"Andersen is hiring a SIEM Administrator / Engineer for a project enhancing a SIEM platform and supporting centralized security monitoring and threat detection. \nOur customer is a technology and consulting organization providing digital infrastructure, cloud services, cybersecurity, data-driven solutions, and managed IT support. It helps organizations modernize complex technology environments, strengthen security, and improve the reliability and scalability of their digital operations. By combining technical expertise with modern technologies and service-oriented delivery, the company supports digital transformation, operational efficiency, and the continuous improvement of critical IT systems across multiple markets. \nThe project is focused on providing cybersecurity and digital services for international organizations within a complex multi-tenant environment. It includes managing and enhancing the SIEM platform to support centralized security monitoring, threat detection, and reliable cyber defense operations across multiple organizations worldwide. \nResponsibilities: \nAdministering, maintaining and upgrading the SIEM platform, including health, performance, capacity and licensing.\n\nOnboarding and normalizing new log sources (network, endpoint, cloud, identity, applications), including in multi-tenant setups.\n\nDeveloping, tuning and maintaining detection rules, correlation searches, dashboards and reports.\n\nReducing false positives together with SOC analysts and implementing new use cases.\n\nBuilding and maintaining SOAR playbooks and integrations.\n\nMaintaining documentation, data retention policies and access control.\n\nSupporting audits and compliance reporting.\n\nRequirements: \nExperience in IT or cybersecurity for 5+ years, including 3+ years administering an enterprise SIEM in production.\n\nDeep hands-on experience with at least one major SIEM: Microsoft Sentinel, Splunk ES, IBM QRadar or Elastic Security.\n\nHands-on experience with log source onboarding, parsing, and normalization using Syslog, CEF, Windows Event Forwarding (WEF), and API-based cloud connectors.\n\nExperience writing detection content in the platform's query language (KQL, SPL, AQL or equivalent).\n\nUnderstanding of MITRE ATT&CK for mapping detection coverage.\n\nClean professional records and willingness to undergo background verification.\n\nLevel of English – from Upper-Intermediate and above.\n\nNice-to-haves: \nVendor certifications (e.g. Microsoft SC-200, Splunk Certified Admin/Architect, IBM QRadar).\n\nSOAR experience (Sentinel Logic Apps, Splunk SOAR, Cortex XSOAR).\n\nMulti-tenant SIEM or MSSP experience.\n\nExperience in scripting and automation (Python, PowerShell) and Infrastructure as Code.\n\nExperience working with detection-as-code practices (Sigma, Git-based rule management).\n\nReasons why this job would be interesting to you: \nExperience in teamwork with leaders in FinTech, Healthcare, Retail, Telecom, and others. Andersen cooperates with such businesses as Samsung, Siemens, Johnson & Johnson, BNP Paribas, Ryanair, Mercedes, TUI, Verivox, Allianz, T-Systems, etc..\n\nThe opportunity to change the project and/or develop expertise in an interesting business domain.\n\nGuarantee of professional, financial, and career growth! The company has introduced systems of mentoring and adaptation for each new employee.\n\nThe opportunity to earn up to an additional 1,000 EUR per month, depending on the level of expertise, which will be included in the annual bonus, by participating in the company's activities.\n\nAccess to the corporate training portal, where the entire knowledge base of the company is collected and which is constantly updated.\n\nBright corporate life (parties / pizza days / PlayStation / fruits / coffee / snacks / movies).\n\nCertification compensation (AWS, PMP, etc).\n\nReferral program.\n\nPrivate health insurance and sports compensation, depending on the type of employment.\n\nYour personal data is protected in accordance with GDPR regulations. Learn more: https://andersenlab.com/privacy-policy/pl\nJoin us! \nhttps://people.andersenlab.com/ \nTech stack\nCybersecurity\nSIEM\nMicrosoft Sentinel\nSplunk ES\nIBM QRadar\nElastic Security\nsyslog\nCEF\nAPI","description_format":"text","description_chars":4178,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Health insurance"],"hiring_locations":[{"name":"Poland","iso":"PL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","IT Outsourcing & Dedicated Teams","Software Testing & QA","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-10-30T14:25:00Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":3,"expected_fill_days":30,"reasons":["seen:3","velocity","win:early","comp:brand"],"computed_at":"2026-11-03T05:54:40Z"},"pay":{"stated_usd_annual":86748,"is_top_pay":false},"html_url":"https://alion.io/job/andersen-siem-administrator-engineer","json_url":"https://alion.io/job/andersen-siem-administrator-engineer.json","meta":{"generated_at":"2026-11-03T08:54:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12717,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8912},"rest":"https://alion.io/mcp/rest/get_company?id=8912"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fandersen-siem-administrator-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fandersen-siem-administrator-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fandersen-siem-administrator-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/andersen-siem-administrator-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fandersen-siem-administrator-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3526770}},{"tool":"search_jobs","arguments":{"company":"andersenlab.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3526770},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}