Job DescriptionThe Impact you will have in this role:Being a member of CISO team, this position will be reporting to the Associate Director, Cyber Threat Defense and Controls within Cybersecurity Engineering & Operations team. The Senior SIEM Engineer will be responsible for the day-to-day decisioning and implementation of the vision of the SIEM roadmap. SIEM includes security logging and monitoring, logging platforms, database activity monitoring, behavior analytics, security orchestration (SOAR), intrusion detection/prevention systems, and incident response capabilities. The Cybersecurity Services (CS) domain within Information Technology is focused on protecting DTCC from cybersecurity risks through world class cyber risk management, talent and governance practices. Cybersecurity Engineering is responsible for providing best in class security services to the enterprise specifically to Security Information Event Management, Vulnerability Management, Identity Access Management, Cloud Security, Network Security, etc.
Your Primary Responsibilities:- Identify, assess, and document security logging and monitoring control gaps, and implement engineering solutions to address identified risks.
- Engineer coverage-monitoring and reconciliation capabilities to identify missing or unhealthy log sources, and partner with platform owners to investigate and remediate gaps.
- Design, implement, configure, and maintain SIEM platforms and ingestion components to support reliable collection and normalization of security telemetry across on-premises and cloud environments.
- Onboard new log sources by configuring collectors, connectors, and data feeds; developing or updating parsers; and validating end-to-end ingestion against agreed requirements.
- Develop and maintain data-quality checks for log completeness, timeliness, parsing accuracy, and required fields, and troubleshooting issues affecting the usability of security telemetry.
- Implement and maintain Central Log Management infrastructure and pipelines to support scalable, resilient collection, routing, storage, and retrieval of log and telemetry data.
- Tune ingestion pipelines, storage, search performance, and retention configurations to balance platform capacity, reliability, and cost with approved requirements.
- Maintain platform health and security through monitoring, troubleshooting, upgrades, patching, access-control configuration, and change management in line with organizational and regulatory requirements.
- Develop scripts, integrations, and automation to streamline log onboarding, coverage reconciliation, data-quality validation, and platform health monitoring.
- Support disaster recovery planning and exercises by validating recovery procedures, platform availability, and restoration of log ingestion.
- Support audits and regulatory assessments by providing technical evidence, documenting control configurations, and implementing assigned remediation actions.
- Collaborate with operations, security monitoring teams, infrastructure and application owners, and vendors to translate monitoring requirements into technical solutions and resolve integration issues.
- Maintain engineering designs, configuration records, implementation procedures, and support runbooks to enable consistent delivery and effective operational handover.
- Develop and maintain dashboards and technical metrics for ingestion health, coverage, data quality, and capacity, and communicate engineering progress, risks, and dependencies to stakeholders.
- Investigate ingestion failures and platform issues, perform root-cause analysis, implement fixes within the Cyber Observability Engineering's managed systems, and coordinate source-side remediation with the accountable IT owners.
- Deliver assigned engineering tasks for platform implementations, migrations, and enhancements, including testing, deployment validation, and transition to operational support.
- Contribute to Cyber Observability Engineering standards, continuous improvement initiatives, and other assigned security observability responsibilities.
NOTE: The Primary Responsibilities of this role are not limited to the details above.*Qualifications:- Minimum of 6 years of related experience
- Bachelor's degree preferred and/or equivalent experience
Talents Needed for Success:- Hands-on experience engineering SIEM and Central Log Management platforms, including collectors, connectors, ingestion pipelines, parsers, normalization, and security telemetry integration.
- Ability to deliver engineering tasks as part of a collaborative team, troubleshoot technical issues, and work with operations, platform owners, and vendors through testing, deployment, and operational handover.
- Demonstrable cybersecurity engineering experience in solution design, configuration, implementation, technical documentation, and validation of log coverage, data quality, platform health, and resilience.
- Knowledge of information security frameworks, control requirements, least-privilege access, change management, and audit evidence relevant to security logging and monitoring.
- Working knowledge of Linux and Windows systems, databases, networking protocols, and security infrastructure, including TCP/IP, HTTP/HTTPS, DNS, syslog, firewalls, proxies, and IDS/IPS.
- Proficiency in scripting and automation using Python, PowerShell, or Bash, with experience integrating REST APIs, processing JSON, using regular expressions, and maintaining code in version control.
- Working knowledge of cloud security in GCP, Azure, or AWS, including shared responsibility, IAM, service accounts, encryption and key management, network controls, cloud audit logging, and secure integration of cloud telemetry with SIEM platforms.
- Familiarity with AI and generative AI tools for engineering automation, code assistance, log analysis, and documentation, including validation of generated outputs and use of approved tools with appropriate data protection and human review.
- Awareness of AI security risks and safeguards, including prompt injection, sensitive-data exposure, access controls, and logging and monitoring of AI-enabled services.
- Relevant security, cloud security, or SIEM platform certifications, such as CEH, CCSP, CISSP, OSCP, or cloud-provider security certifications, are a plus.
The salary range is indicative for roles at the same level within DTCC across all US locations. Actual salary is determined based on the role, location, individual experience, skills, and other considerations.
Learn more about Clearance and Settlement by clicking here.
