SIEM Engineer

pWe are seeking an experienced SIEM Data Onboarding Engineer to support the integration of new data sources into our Splunk-based Security Information and Event Management (SIEM) platform. The consultant will work closely with security operations, infrastructure, application, and business teams to ensure log sources are onboarded efficiently, normalized appropriately, and aligned with security monitoring requirements. /ppExperience with Cribl is highly desirable, as it is used to optimize, route, transform, and manage telemetry data flows into Splunk. /ph3Key Responsibilities /h3ulliLead and execute onboarding of new log and telemetry sources into Splunk. /liliGather technical requirements from stakeholders and source system owners. /liliDesign and implement data ingestion pipelines. /liliConfigure, validate, and troubleshoot data collection mechanisms. /liliEnsure logs are properly parsed, normalized, and mapped to the Splunk Common Information Model (CIM), where applicable. /liliDevelop and maintain onboarding documentation, data flow diagrams, and operational procedures. /liliWork with cybersecurity teams to understand use cases and ensure onboarding supports detection and monitoring requirements. /liliPerform data quality assessments and resolve ingestion issues. /liliOptimize data flows to improve performance, scalability, and cost efficiency. /liliSupport onboarding of cloud, infrastructure, network, security, and application data sources. /liliContribute to continuous improvement of the SIEM data onboarding framework and standards. /li /ulh3Required Skills Experience /h3h3Splunk /h3ulliStrong hands-on experience with Splunk Enterprise and/or Splunk Cloud. /liliExperience onboarding and managing diverse log sources. /liliKnowledge of Universal Forwarders, Heavy Forwarders, Data Inputs, index management, source types, field extractions, Splunk CIM, and Search Processing Language (SPL). /liliExperience troubleshooting data ingestion and parsing issues. /li /ulh3SIEM Security /h3ulliGood understanding of SIEM concepts and security monitoring. /liliFamiliarity with security logs from operating systems (Windows/Linux), network devices, security appliances, cloud platforms (Azure, AWS, GCP), applications, and middleware. /liliUnderstanding of log management and event correlation principles. /liliExperience with log transport technologies and ingestion architectures. /liliUnderstanding of JSON, XML, Syslog, REST APIs, and event streaming concepts. /liliExperience with scripting or automation using Python, PowerShell, or similar technologies. /li /ulh3Preferred Qualifications /h3h3Cribl /h3ulliHands-on experience with Cribl Stream and/or related Cribl products. /liliExperience creating pipelines, routing rules, transformations, and filtering logic. /liliKnowledge of observability and telemetry optimization practices. /liliExperience reducing SIEM ingestion costs through data engineering techniques. /liliUnderstanding of SOC operations and detection engineering. /liliExperience working in enterprise-scale environments. /liliKnowledge of cloud-native logging and monitoring services. /li /ulh3Profile /h3ulliStrong analytical and troubleshooting skills. /liliAbility to work independently with limited supervision. /liliExcellent stakeholder management and communication skills. /liliComfortable working across infrastructure, security, and application teams. /liliDocumentation-oriented with strong attention to detail. /liliFluent in English; Dutch and/or French are a plus. /li /ulpThe ideal service deliverer has extensive experience onboarding complex data sources into Splunk environments and can independently drive integration activities from requirements gathering through production deployment. Experience with Cribl and large-scale SIEM environments will be considered a significant advantage /p