Skip to main content
All roles

SIEM Engineer

Engineer the third-party half of Falcon Next-Gen SIEM: ingest, parsing and detection content that reaches past the endpoint.

Remote — US full timeVJL-SOC-001

The role

NextDefend™ is Vijilan's managed CrowdStrike Falcon Next-Gen SIEM service, delivered as Deploy · Sustain · Operate. You are the engineer who makes the SIEM see the whole environment, not just what the endpoint agent already covers: onboarding third-party sources, parsing them to the CrowdStrike Parsing Standard, shaping data at the edge with Falcon Onum and Cribl Stream so ingest cost stays predictable, and writing the detection content the SOC runs on.

What you'll own

  • Source onboarding — firewalls, identity providers, cloud control planes, SaaS — from raw feed to parsed, normalized, searchable.
  • Parsers and normalization to the CrowdStrike Parsing Standard, tested against real samples.
  • Pipeline engineering in Falcon Onum and Cribl Stream: routing, reduction, enrichment at the edge.
  • Detection content — correlation rules and scheduled searches — with the false-positive tuning that keeps analysts trusting the queue.
  • Runbooks and documentation the SOC can execute at 3am without you.

What we're looking for

  • Hands-on SIEM engineering experience (Falcon NG-SIEM, LogScale/Humio, Splunk, Sentinel or similar) — parsing and detection authoring, not just console use.
  • Comfort with regex, JSON, and at least one scripting language for glue work.
  • You understand log sources as systems: what a domain controller, a firewall and an IdP each actually record.
  • Experience with pipeline tools (Cribl, Onum, Logstash) is a strong plus; so is a CrowdStrike certification held by you.

About Vijilan

Vijilan Security runs a 24/7 security operations center. Founded in 2014 and headquartered in Hallandale Beach, Florida, we watch, investigate and contain threats for organizations across North America and LATAM — through MSP and MSSP partners, through VARs and distributors, and direct to mid-market and enterprise.

ISO/IEC 27001 Certified · SOC 2 Type II Audited · CrowdStrike Powered Service Provider (CPSP)

Apply for this role

Four fields and your resume. No account, no portal, no cover letter unless you want to write one.

A personal address is fine, and usually wiser.

Resume

We keep this to consider you for this role and, only if you tick the box above, to send you one email about Vijilan Academy. Nothing else. Your resume is stored privately and read only by the people running this hire. Ask us to delete it at any point and we will.

Know someone who should see this?

Equal opportunity

Vijilan Security is an equal opportunity employer. We consider every qualified applicant without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other characteristic protected by law.

Accommodations

If you need an adjustment at any stage, in the application, the conversations or the working session, tell us and we will arrange it. You do not need to explain why, and asking has no bearing on the decision.

Your data

We collect what we need to consider you for this role and, only if you tick the box asking for it, to send you one email about Vijilan Academy. Nothing else. Your resume is stored privately and is readable only by the people running this hire, each access recorded. Ask us to delete it at any point and we will.

Automated review

A human being makes every decision about every candidate here, including every rejection. Where automated analysis is used to summarize or organize applications, it is disclosed on the posting rather than buried in a policy, and it never decides an outcome on its own.