Senior SIEM Engineer

Are you ready to make an impact at DTCC?

Do you want to work on innovative projects, collaborate with a dynamic and supportive team, and receive investment in your professional development? At DTCC, we are at the forefront of innovation in the financial markets. We are committed to helping our employees grow and succeed. We believe that you have the skills and drive to make a real impact. We foster a thriving internal community and are committed to creating a workplace that looks like the world that we serve.

The Information Technology group delivers secure, reliable technology solutions that enable DTCC to be the trusted infrastructure of the global capital markets. The team delivers high-quality information through activities that include development of essential, building infrastructure capabilities to meet client needs and implementing data standards and governance.

Pay and Benefits:

• Competitive compensation, including base pay and annual incentive
• Comprehensive health and life insurance and well-being benefits, based on location
• Pension / Retirement benefits
• Paid Time Off and Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.
• DTCC offers a flexible/hybrid model of 3 days onsite and 2 days remote (onsite Tuesdays, Wednesdays and a third day unique to each team or employee).

The Impact you will have in this role:

Being a member of CISO team, this position will be reporting to the Associate Director, Cyber Threat Defense and Controls within Cybersecurity Engineering & Operations team. The Senior SIEM Engineer will be responsible for the day-to-day decisioning and implementation of the vision of the SIEM roadmap. SIEM includes security logging and monitoring, logging platforms, database activity monitoring, behavior analytics, security orchestration (SOAR), intrusion detection/prevention systems, and incident response capabilities. The Cybersecurity Services (CS) domain within Information Technology is focused on protecting DTCC from cybersecurity risks through world class cyber risk management, talent and governance practices. Cybersecurity Engineering is responsible for providing best in class security services to the enterprise specifically to Security Information Event Management, Vulnerability Management, Identity Access Management, Cloud Security, Network Security, etc.

Your Primary Responsibilities:

• Identify, assess, and document security logging and monitoring control gaps, and implement engineering solutions to address identified risks.
• Engineer coverage-monitoring and reconciliation capabilities to identify missing or unhealthy log sources, and partner with platform owners to investigate and remediate gaps.
• Design, implement, configure, and maintain SIEM platforms and ingestion components to support reliable collection and normalization of security telemetry across on-premises and cloud environments.
• Onboard new log sources by configuring collectors, connectors, and data feeds; developing or updating parsers; and validating end-to-end ingestion against agreed requirements.
• Develop and maintain data-quality checks for log completeness, timeliness, parsing accuracy, and required fields, and troubleshooting issues affecting the usability of security telemetry.
• Implement and maintain Central Log Management infrastructure and pipelines to support scalable, resilient collection, routing, storage, and retrieval of log and telemetry data.
• Tune ingestion pipelines, storage, search performance, and retention configurations to balance platform capacity, reliability, and cost with approved requirements.
• Maintain platform health and security through monitoring, troubleshooting, upgrades, patching, access-control configuration, and change management in line with organizational and regulatory requirements.
• Develop scripts, integrations, and automation to streamline log onboarding, coverage reconciliation, data-quality validation, and platform health monitoring.
• Support disaster recovery planning and exercises by validating recovery procedures, platform availability, and restoration of log ingestion.
• Support audits and regulatory assessments by providing technical evidence, documenting control configurations, and implementing assigned remediation actions.
• Collaborate with operations, security monitoring teams, infrastructure and application owners, and vendors to translate monitoring requirements into technical solutions and resolve integration issues.
• Maintain engineering designs, configuration records, implementation procedures, and support runbooks to enable consistent delivery and effective operational handover.
• Develop and maintain dashboards and technical metrics for ingestion health, coverage, data quality, and capacity, and communicate engineering progress, risks, and dependencies to stakeholders.
• Investigate ingestion failures and platform issues, perform root-cause analysis, implement fixes within the Cyber Observability Engineering’s managed systems, and coordinate source-side remediation with the accountable IT owners.
• Deliver assigned engineering tasks for platform implementations, migrations, and enhancements, including testing, deployment validation, and transition to operational support.
• Contribute to Cyber Observability Engineering standards, continuous improvement initiatives, and other assigned security observability responsibilities.

NOTE: The Primary Responsibilities of this role are not limited to the details above.*

Qualifications:

• Minimum of 6 years of related experience
• Bachelor's degree preferred and/or equivalent experience

Talents Needed for Success:

• Hands-on experience engineering SIEM and Central Log Management platforms, including collectors, connectors, ingestion pipelines, parsers, normalization, and security telemetry integration.
• Ability to deliver engineering tasks as part of a collaborative team, troubleshoot technical issues, and work with operations, platform owners, and vendors through testing, deployment, and operational handover.
• Demonstrable cybersecurity engineering experience in solution design, configuration, implementation, technical documentation, and validation of log coverage, data quality, platform health, and resilience.
• Knowledge of information security frameworks, control requirements, least-privilege access, change management, and audit evidence relevant to security logging and monitoring.
• Working knowledge of Linux and Windows systems, databases, networking protocols, and security infrastructure, including TCP/IP, HTTP/HTTPS, DNS, syslog, firewalls, proxies, and IDS/IPS.
• Proficiency in scripting and automation using Python, PowerShell, or Bash, with experience integrating REST APIs, processing JSON, using regular expressions, and maintaining code in version control.
• Working knowledge of cloud security in GCP, Azure, or AWS, including shared responsibility, IAM, service accounts, encryption and key management, network controls, cloud audit logging, and secure integration of cloud telemetry with SIEM platforms.
• Familiarity with AI and generative AI tools for engineering automation, code assistance, log analysis, and documentation, including validation of generated outputs and use of approved tools with appropriate data protection and human review.
• Awareness of AI security risks and safeguards, including prompt injection, sensitive-data exposure, access controls, and logging and monitoring of AI-enabled services.
• Relevant security, cloud security, or SIEM platform certifications, such as CEH, CCSP, CISSP, OSCP, or cloud-provider security certifications, are a plus.

The salary range is indicative for roles at the same level within DTCC across all US locations. Actual salary is determined based on the role, location, individual experience, skills, and other considerations. We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, sex, gender, gender expression, sexual orientation, age, marital status, veteran status, or disability status. We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.