EYTC-CS-CDR-NG SIEM-Senior
About this role
Key Responsibilities
- Lead onboarding of strategic log sources via Cribl, cloud collectors, API pipelines.
- Build and optimize parsing, normalization, and enrichment logic.
- Create advanced detections mapped to MITRE ATT&CK using SPL/KQL/CQL/CQL-Advanced.
- Design and optimize correlation logic using Fusion/ML-based engines.
- Lead tuning and noise-reduction activities for Fusion correlation rules.
- Oversee case lifecycle management: triage workflows, enrichments, severity logic, and SLA tracking.
- Develop and maintain SOAR playbooks for automated enrichment, notifications, containment tasks.
- Integrate external systems (EDR, IAM, Email, Firewall) into SOAR workflows.
- Conduct root-cause analysis for ingestion and correlation gaps.
- Collaborate with Threat Intel and Detection teams for new use cases.
- Leverage AI assistants like Charlotte AI and Sentinel Copilot to optimize detection creation, accelerate query building, and reduce investigation time.
- Integrate Microsoft Sentinel with Copilot to enable AI-driven incident summarization, RCA assistance, KQL generation, and automated SOC workflows.
- Evaluate and implement AI‑powered SOAR capabilities, including automated enrichment, clustering of similar alerts, and anomaly‑based playbook triggers.
Skills & Experience
- 3–6 years in SIEM engineering or SOC detection.
- Strong hands-on experience with Fusion Correlation Engine (CrowdStrike), Azure Sentinel Analytics, or Splunk ES Correlation Searches.
- Experience creating/maintaining SOAR playbooks (Fusion workflows, Sentinel Logic Apps, Splunk SOAR).
- Deep knowledge of case management workflows and alert lifecycle governance.
- Strong in ingestion engineering using Cribl Stream & Lake.
- Expertise in SPL, KQL, CQL query languages.
- Understanding of data models, schemas, threat modelling.
EY | Building a better working world
EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.
Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.
EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.
Apply now » Apply now- Start applying with LinkedIn
- Apply Now Start
-
Please wait...
- Connect with us
- Our locations
- My EY
- Site map
- Legal and privacy
- Labor condition applications
- Cookie Consent Manager
-
Opens in a new tab.
-
Opens in a new tab.
-
Opens in a new tab.
-
Opens in a new tab.
-
Opens in a new tab.
EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
×Cookie Consent Manager
When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. Because we respect your right to privacy, you can choose not to allow some types of cookies. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.
Required Cookies
These cookies are required to use this website and can't be turned off.
Required Cookies Show More Details Required Cookies Provider Description Enabled SAP as service provider We use the following session cookies, which are all required to enable the website to function:- "route" is used for session stickiness
- "careerSiteCompanyId" is used to send the request to the correct data center
- "JSESSIONID" is placed on the visitor's device during the session so the server can identify the visitor
- "Load balancer cookie" (actual cookie name may vary) prevents a visitor from bouncing from one instance to another