Security Operations Center – SIEM Architect

Introduction

Vanderlande’s Security Operations Center (SOC) is looking for a SIEM Engineer with experience designing, operating, and optimizing enterprise security monitoring platforms. The role requires skill in log ingestion, detection engineering, alert tuning, and dashboard development to support SOC operations, incident response, and compliance requirements.

What will you be doing?

• Onboard log sources (Windows, Linux, firewalls, cloud, SaaS apps)
• Parse and normalize logs so data is searchable and consistent
• Create detection rules and alerts for threats such as brute force, malware, and insider risk
• Tune alerts to reduce false positives
• Build dashboards and reports for SOC teams and leadership
• Maintain performance and reliability of the SIEM
• Support incident response by helping analysts investigate alerts
• Ensure compliance, including log retention for NIS2, ISO 27001, and IEC62443

What are your responsibilities?

• Engineer and maintain multitenant SIEM platforms, supporting enterprise-scale security monitoring
• Onboard and normalize logs from servers, endpoints, network devices, cloud services, and security tools such as EDR, IAM, IDS, and firewalls
• Develop and tune correlation rules, detections, and alerts, reducing false positives and improving threat detection accuracy
• Map detections to the MITRE ATT&CK framework to strengthen coverage of adversary techniques
• Build operational and executive dashboards to improve SOC visibility and reporting
• Integrate threat intelligence feeds to enhance detection capabilities
• Support SOC analysts during investigations by providing log analysis and forensic context
• Automate SIEM tasks and data processing using Python, PowerShell, and Bash
• Optimize log retention and storage to balance performance, cost, and regulatory requirements
• Document SIEM architecture, detections, and onboarding processes for audit readiness

What do we ask from you?

Desired Technical Skills

• SIEM Platforms: Splunk, Microsoft Sentinel, Exabeam, Elastic
• Log Sources: Windows Event Logs, Linux Syslog, Firewall, Proxy, IAM, EDR
• Cloud Logging: Azure Monitor, AWS CloudTrail, GCP Logging
• Security Frameworks: MITRE ATT&CK, NIST, Incident Response Lifecycle
• Scripting & Automation: Python, PowerShell, Bash
• Networking: TCP/IP, DNS, HTTP/S

Other Skills

• Strong analytical and problem-solving skills
• Ability to communicate technical issues to non-technical stakeholders
• Attention to detail and documentation
• Ability to work independently and collaboratively

Experience

• 4+ years in cybersecurity, SIEM engineering, SOC operations, or a related role
• Experience onboarding and managing large-scale log environments

What we offer

In this challenging and responsible position, you will have the chance to make a significant contribution to industry-leading projects and be connected to our dedicated people and customers. We offer a position in an informal, international, and professional working environment with a lot of scope for personal development. By joining our profitable and growing company, you will be able to reach your goals and focus on your future.

• 40 vacation days (20 statutory days and a flexible budget worth 20 days)
• Flexible working hours
• A hybrid workplace (40% working from home and 60% in the office)
• A Health & Wellbeing budget worth €300 per calendar year
• Commuting allowance, including full reimbursement of travel by public transport
• Working from home allowance
• Collective pension scheme and discount on additional health insurance
• On-site company health centres with a gym, physiotherapists, and occupational therapists
• Vanderlande Academy and training facilities to boost your skills
• A variety of Vanderlande Network communities and initiatives
• A great company restaurant and coffee bar with barista

Background screening

For this position it is possible that a background screening will be conducted. This screening can include checks such as verification of identity, qualifications, or other relevant records, which may include criminal background or sanctions list checks, in accordance with internal policies and applicable laws. Any job offer may be extended under the condition that the screening does not give reason to reconsider the hiring decision.