{"id":2093984,"url":"https://alion.io/job/g42-lead-soc-engineer-siem-soar","title":"Lead SOC Engineer (SIEM & SOAR)","company":{"id":190,"name":"G42","domain":"g42.ai","url":"https://alion.io/company/g42","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Phenom","truth_index":{"grade":"A","score":100,"open_postings":5,"ghost_share":0,"stale_share":0,"repost_share":0.2,"time_to_fill_p50_days":15,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United Arab Emirates"],"countries":["AE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":36000,"max_usd":95000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":679},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-10-08T13:57:02Z","employer_posted_date":"2026-10-08","last_verified_at":"2026-10-22T08:32:50Z","board_verified":true,"closed_at":null,"days_open":13,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":13},"description":"Overview:\nThe Lead Engineer - SOC (SIEM & SOAR) is a critical role responsible for delivering SIEM /SOAR management services, particularly focusing on Splunk SIEM and SOAR, within the Security Operations Center (SOC). This role encompasses working closely with the SOC Internal and external teams to facilitate onboarding new log sources, enhancing and optimizing telemetry, ensuring system updates, resolving issues, and maintaining SIEM performance, automation and orchestration, designing playbooks according to best practices achieved through SOAR Solution.\nResponsibilities:\nKey Responosibilities\nDeliver Splunk SIEM /SOAR management services within the SOC environment.\nCollaborate with the asset owner, client stakeholder, and SOC, in onboarding new log sources to the SIEM/SOAR platform.\nMaintain and govern SOC critical log sources, ensuring their proper functionality and integration with Splunk SIEM /SOAR.\nDetect log source issues, coordinate with customers to diagnose and resolve them in a timely manner.\nEnhance and optimize telemetry within the Splunk environment to improve data collection, correlation, and reporting.\nPerform regular system updates to ensure Splunk functionality and security are up to date.\nResolve Splunk-related issues promptly and efficiently.\nProficiency in field extractions, data normalization, and CIM (Common Information Model) compliance.\nMaintain the performance of the Splunk SIEM /SOAR according to established best practices.\nDesign SOAR Playbooks to enhance automation and orchestration of incidents.\nConnect SOAR with SIEM, ticketing systems (e.g., ServiceNow), threat intelligence platforms, and endpoint tools.\nExperience with platforms like Splunk SOAR (Phantom), Forti SOAR, or Cortex XSOAR.\nParticipate in continuous process improvements to increase SOC efficiency and effectiveness.\nProvide regular and accurate reports on Splunk services and SOC operations to relevant stakeholders.\nContribute to SOC architecture strategy and implementation initiatives related to Splunk.\nAssist in the mentorship and development of junior SOC engineers.\nCharacteristics:\nProfound knowledge and hands-on experience with Splunk SIEM/SOAR and other related technologies like CRIBL.\nUnderstanding of SOC workflows, MITRE ATT&CK framework, and threat detection methodologies.\nAbility to correlate data across multiple sources to identify patterns and anomalies.\nStrong understanding of cloud and network technologies, essential for efficient log source onboarding.\nProven technical capabilities in a complex, fast-paced SOC environment.\nAbility to diagnose and troubleshoot log source issues related to cloud and network infrastructures.\nStrong understanding of SOC operations, cybersecurity principles, and best practices.\nExcellent problem-solving skills and the ability to make decisions under pressure.\nAbility to collaborate effectively with a variety of team members, including interfacing with customers to resolve issues.\nHigh proficiency in written and verbal communication.\nQualifications:\nSkills/Certifications\nSplunk Certified Architect or Splunk Certified Administrator.\nMastery of SPL (Search Processing Language) for complex queries, dashboards, and reports.\nPython scripting skills.\nExperience with platforms like Forti SOAR, Splunk SOAR (Phantom), Cortex XSOAR etc.\nCloud-related certifications like AWS Certified Solutions Architect, Google Professional Cloud Architect, or Microsoft Certified: Azure Solutions Architect Expert.\nCertified Information Systems Security Professional (CISSP), GIAC is preferred\nNetworking certifications such as CCNA or CCNP are advantageous.\nMinimum Work Experience\nA minimum of 8 years of experience in SOC operations, with significant experience in Splunk SIEM management.\nPrior experience in a technical role within a SOC or similar cybersecurity environment.\nEducation\nBachelor’s degree in computer science, Information Technology, Cybersecurity, or a related field.","description_format":"text","description_chars":3957,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Security Operations","LLM & Generative AI","AI Compute & Inference"],"lifecycle":[{"event":"open","at":"2026-10-08T16:03:33Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.795,"p_room":0.75,"age_days":13,"expected_fill_days":15,"reasons":["conf:1","velocity","win:late"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/g42-lead-soc-engineer-siem-soar","json_url":"https://alion.io/job/g42-lead-soc-engineer-siem-soar.json","meta":{"generated_at":"2026-10-22T10:37:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7943,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":190},"rest":"https://alion.io/mcp/rest/get_company?id=190"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fg42-lead-soc-engineer-siem-soar"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fg42-lead-soc-engineer-siem-soar"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fg42-lead-soc-engineer-siem-soar"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/g42-lead-soc-engineer-siem-soar\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fg42-lead-soc-engineer-siem-soar"}]}