Senior SIEM Engineer - (NPW)

• *Company Overview**
• -------------------

Milestone Technologies is a global IT managed services firm that partners with organizations to scale their technology, infrastructure and services to drive specific business outcomes such as digital transformation, innovation, and operational agility. Milestone is focused on building an employee\-first, performance\-based culture and for over 25 years, we have a demonstrated history of supporting category\-defining enterprise clients that are growing ahead of the market. The company specializes in providing solutions across Application Services and Consulting, Digital Product Engineering, Digital Workplace Services, Private Cloud Services, AI/Automation, and ServiceNow. Milestone culture is built to provide a collaborative, inclusive environment that supports employees and empowers them to reach their full potential.

Our seasoned professionals deliver services based on Milestone’s best practices and service delivery framework. By leveraging our vast knowledge base to execute initiatives, we deliver both short\-term and long\-term value to our clients and apply continuous service improvement to deliver transformational benefits to IT. With Intelligent Automation, Milestone helps businesses further accelerate their IT transformation. The result is a sharper focus on business objectives and a dramatic improvement in employee productivity. Through our key technology partnerships and our people\-first approach, Milestone continues to deliver industry\-leading innovation to our clients. With more than 3,000 employees serving over 200 companies worldwide, we are following our mission of revolutionizing the way IT is deployed.

• *Job Overview**
• ---------------

We are looking for **Senior SIEM Engineer** to support a client’s **Next Generation Security Event Management** program. The client is migrating SIEM capability from **IBM QRadar to Elastic Security Stack** and needs experienced engineers to support **data\-source onboarding, Elastic ingestion, ECS normalization, and detection logic development**.

• *Role Summary**

The Senior SIEM Engineer will be responsible for onboarding and operationalizing prioritized security telemetry into **Elastic Security**, including creation and maintenance of **data streams, ingest pipelines, index templates, field mappings, ECS normalization, and detection rules**. The role requires strong hands\-on experience in Elastic SIEM engineering, security log ingestion, parsing, detection engineering, and working with SOC/security monitoring teams.

• *Key Responsibilities**

• Assess security log sources for onboarding readiness, including connectivity, log format, volume, collection method, parsing needs, data quality, field availability, and detection suitability.
• Design, configure, test, and maintain **Elastic data streams**, index templates, component templates, mappings, naming conventions, lifecycle policies, and retention settings.
• Develop and maintain **Elastic ingest pipelines** to parse, enrich, transform, and normalize security events.
• Map source fields to **Elastic Common Schema (ECS)** or approved security data models.
• Validate end\-to\-end telemetry ingestion into Elastic, including timestamp accuracy, parsing success, field extraction, mapping conflicts, duplicate events, data loss, and pipeline failures.
• Design, develop, test, tune, and deploy detection rules and security use cases in **Elastic Security**.
• Build detection logic using **KQL, EQL, ES\|QL, threshold rules, correlation logic, exceptions, risk scoring, and rule metadata**.
• Map detections to relevant **MITRE ATT\&CK tactics, techniques, and sub\-techniques**.
• Document detection logic, test evidence, tuning decisions, false\-positive considerations, known limitations, and production\-readiness recommendations.
• Troubleshoot ingestion, parsing, ECS mapping, indexing, alerting, detection, and performance issues across Elasticsearch and Kibana.
• Partner with SIEM Engineering, SOC, Threat Intelligence, application owners, source\-system owners, and third\-party teams such as Cribl.
• Maintain technical documentation, runbooks, implementation evidence, deployment records, risks, dependencies, and operational handover artifacts.
• Provide regular status updates on progress, blockers, risks, dependencies, and decisions required.

• *Required Skills and Experience**

• **7\+ years in cybersecurity / SIEM engineering**, with at least **3\+ years of hands\-on Elastic Security / Elasticsearch / Kibana experience** preferred.
• Strong hands\-on experience as a **SIEM Engineer / Detection Engineer / Security Data Engineer**.
• Practical experience with **Elastic Security / Elastic SIEM / Elasticsearch / Kibana**.
• Experience creating and maintaining **data streams, ingest pipelines, mappings, index templates, and lifecycle configurations**.
• Strong knowledge of **security log ingestion, parsing, enrichment, transformation, and normalization**.
• Experience with **Elastic Common Schema (ECS)** mapping and data\-model alignment.
• Hands\-on experience writing detection rules using **KQL, EQL, ES\|QL**, threshold logic, and correlation logic.
• Good understanding of **SOC operations, alert triage, incident detection, and security monitoring use cases**.
• Experience mapping detections to **MITRE ATT\&CK**.
• Ability to troubleshoot log ingestion, parsing, indexing, pipeline, and alerting issues.
• Strong documentation skills, including runbooks, design notes, validation evidence, and operational handover documents.
• Ability to work independently with multiple technical stakeholders and source\-system owners.

• *Good to Have**

• Experience with **IBM QRadar to Elastic migration**.
• Experience with **Cribl** for log routing, transformation, and enrichment.
• Experience with cloud, endpoint, identity, network, firewall, application, and infrastructure log sources.
• Familiarity with change\-management and production deployment processes in enterprise environments.
• Experience in regulated or large enterprise environments.

• *Tools / Technologies**

• Elastic Security
• Elasticsearch
• Kibana
• Elastic Ingest Pipelines
• Elastic Common Schema
• KQL / EQL / ES\|QL
• MITRE ATT\&CK
• Cribl
• IBM QRadar
• Jira / Confluence or similar tracking and documentation tools

• *Expected Profile**

• Senior\-level SIEM professional with strong hands\-on Elastic engineering experience.
• Must be comfortable with both **data engineering for security telemetry** and **detection engineering**.
• Should be proactive, documentation\-focused, and able to coordinate across SOC, security engineering, application, infrastructure, and vendor teams.

• *Compensation**
• ---------------

Estimated Pay Range

Exact compensation and offers of employment are dependent on circumstances of each case and will be determined based on job\-related knowledge, skills, experience, licenses or certifications, and location.

• *Our Commitment to Diversity \& Inclusion**
• -------------------------------------------

• At Milestone we strive to create a workplace that reflects the communities we serve and work with, where we all feel empowered to bring our full, authentic selves to work. We know creating a diverse and inclusive culture that champions equity and belonging is not only the right thing to do for our employees but is also critical to our continued success.*

• Milestone Technologies provides equal employment opportunity for all applicants and employees. All qualified applicants will receive consideration for employment and will not be discriminated against on the basis of race, color, religion, gender, gender identity, marital status, age, disability, veteran status, sexual orientation, national origin, or any other category protected by applicable federal and state law, or local ordinance. Milestone also makes reasonable accommodations for disabled applicants and employees.*

• We welcome the unique background, culture, experiences, knowledge, innovation, self\-expression and perspectives you can bring to our global community. Our recruitment team is looking forward to meeting you.*