System Engineer Cybersecurity (SIEM/Elastic)

About the mandate

You join a project team that is integrating a SIEM and Log Analytics solution for the Security Operations Center (SOC) and the SecOps team of a large organisation. Together with the architect and the project manager, you support the onboarding of log data and, thanks to your experience, make the necessary changes to the SIEM tools. You help implement the Elastic stack (Elastic Search, Kibana, Logstash, Kafka) and connect a predefined list of systems and applications. You manage Elastic Search and Kibana, build dashboards and reports based on the needs of SecOps and of application and infrastructure owners, and provide the necessary documentation. Hybrid working is possible.

Responsibilities

• Design, manage, configure and optimise the Elastic Security SIEM platform to collect and correlate security events
• Build and maintain security solutions based on Elastic Search together with the team
• Integrate threat intelligence feeds into the SIEM and Elastic Search for proactive threat hunting
• Carry out SIEM platform upgrades regularly and ensure scalability and reliability
• Monitor security logs, alerts and reports to detect issues and anomalies in data and cloud environments
• Use Elastic Search to index and search security-related data for analysis and reporting
• Onboard logs from a predefined list of systems and applications
• Create and maintain dashboards, reports, diagrams, manuals and procedures

Must-haves

• Proven experience as a security engineer with a focus on SIEM and the Elastic stack (Kibana, Logstash, Kafka)
• Expert in Elastic Search: indexing, queries and data visualisation
• Experience with API scripting and programming (e.g. Python or ES/QL) for automation and custom tools
• Strong experience with logging integration in cloud environments such as AWS and Azure
• Experience with Windows and Linux, EDR, cloud-native stacks (including Kubernetes), log management, intrusion detection, email gateways and network security
• Knowledge of Elastic APM and SIEM modules and Elastic Agent
• Knowledge of cybersecurity frameworks and standards (e.g. SOC2, ISO 27001)
• Dutch or French with active knowledge, strong communication and problem-solving skills under pressure

Nice-to-haves

• English

What the employer offers

• Hybrid working possible