SIEM Engineer
Engineer the third-party half of Falcon Next-Gen SIEM: ingest, parsing and detection content that reaches past the endpoint.
The role
NextDefend™ is Vijilan's managed CrowdStrike Falcon Next-Gen SIEM service, delivered as Deploy · Sustain · Operate. You are the engineer who makes the SIEM see the whole environment, not just what the endpoint agent already covers: onboarding third-party sources, parsing them to the CrowdStrike Parsing Standard, shaping data at the edge with Falcon Onum and Cribl Stream so ingest cost stays predictable, and writing the detection content the SOC runs on.
What you'll own
- Source onboarding — firewalls, identity providers, cloud control planes, SaaS — from raw feed to parsed, normalized, searchable.
- Parsers and normalization to the CrowdStrike Parsing Standard, tested against real samples.
- Pipeline engineering in Falcon Onum and Cribl Stream: routing, reduction, enrichment at the edge.
- Detection content — correlation rules and scheduled searches — with the false-positive tuning that keeps analysts trusting the queue.
- Runbooks and documentation the SOC can execute at 3am without you.
What we're looking for
- Hands-on SIEM engineering experience (Falcon NG-SIEM, LogScale/Humio, Splunk, Sentinel or similar) — parsing and detection authoring, not just console use.
- Comfort with regex, JSON, and at least one scripting language for glue work.
- You understand log sources as systems: what a domain controller, a firewall and an IdP each actually record.
- Experience with pipeline tools (Cribl, Onum, Logstash) is a strong plus; so is a CrowdStrike certification held by you.
About Vijilan
Vijilan Security runs a 24/7 security operations center. Founded in 2014 and headquartered in Hallandale Beach, Florida, we watch, investigate and contain threats for organizations across North America and LATAM — through MSP and MSSP partners, through VARs and distributors, and direct to mid-market and enterprise.
ISO/IEC 27001 Certified · SOC 2 Type II Audited · CrowdStrike Powered Service Provider (CPSP)
Hands-on SIEM engineering experience with Falcon NG-SIEM, LogScale/Humio, Splunk, or Sentinel; regex, JSON, and scripting; understanding of log sources; pipeline tools and CrowdStrike certification preferred.
Key Responsibilities
- onboarding log sources
- writing detection content
- building pipelines
Skills & Tools
CrowdStrike Falcon Next-Gen SIEM, Falcon Onum, Cribl Stream, LogScale, Humio, Splunk, Sentinel, Logstash, regex, JSON
Job Details
- Category: Information Technology
- Seniority: Mid Level
- Commitment: Full Time
- Workplace: Remote — United States
- Languages: English
About Vijilan Security
A 24/7 security operations center providing managed detection and response services. — Industry: Information Technology