Senior SIEM Engineer

About Coalfire

Coalfire is on a mission to make the world a safer place by solving our clients’ hardest cybersecurity challenges. We work at the cutting edge of technology to advise, assess, automate, and ultimately help companies navigate the ever-changing cybersecurity landscape. We are headquartered in Chicago, Illinois with offices across the U.S. and U.K., and we support clients around the world.
But that’s not who we are – that’s just what we do.
We are thought leaders, consultants, and cybersecurity experts, but above all else, we are a team of passionate problem-solvers who are hungry to learn, grow, and make a difference.

POSITION SUMMARY:

Coalfire is on a mission to make the world a safer place by solving our clients’ toughest cybersecurity challenges.

As a leading cybersecurity solutions provider serving both private and public sector clients, we work at the cutting edge of technology—advising, assessing, automating, and guiding organizations through the ever-changing security landscape. Our professionals thrive on delivering unbiased assessments, expert guidance, and innovative strategies tailored to each client’s unique needs.

We are looking for a SIEM Platform Engineer to design, implement, operate, and continuously improve the security information and event management platforms that support Coalfire ’s managed security and compliance services. This role owns the reliability and scalability of SIEM platform capabilities across cloud and high-compliance environments, including log collection, data onboarding, platform health, retention, performance, access, integrations, and operational automation.

The SIEM Platform Engineer partners closely with detection engineering, security operations, cloud engineering, compliance, and client stakeholders. The role ensures that SIEM platforms deliver high-quality, accessible, and appropriately governed security data while supporting continuous monitoring and regulatory requirements such as FedRAMP.

What You'll Do

ESSENTIAL RESPONSIBILITIES:

- Design, implement, and maintain SIEM platform architectures across AWS, Azure, and GCP environments.

- Build and operate reliable log collection and ingestion pipelines, including forwarders, collectors, connectors, APIs, syslog, agents, and cloud-native services.

- Onboard, normalize, validate, and troubleshoot data sources from cloud platforms, operating systems, applications, network devices, identity systems, endpoint tools, and security controls.

- Establish and maintain platform standards for parsing, data models, field mappings, naming, tagging, retention, archival, access, and lifecycle management.

- Perform SIEM platform administration, including configuration, upgrades, patching, capacity planning, performance tuning, storage optimization, licensing, and availability monitoring.

- Develop and maintain infrastructure-as-code, automation, and deployment workflows using tools such as Terraform, Ansible, GitLab, GitHub, Python, or comparable technologies.

- Implement platform monitoring and health checks that identify ingestion gaps, pipeline failures, data quality issues, latency, resource constraints, and service degradation.

- Support the secure integration of SIEM platforms with endpoint, identity, vulnerability management, threat intelligence, network security, ticketing, and incident response systems.

- Provide dependable data and platform services to detection engineering and security operations teams; collaborate on use-case enablement without owning the full detection-development lifecycle.

- Support FedRAMP continuous monitoring and related compliance requirements by maintaining platform configurations, operational records, evidence, and repeatable procedures.

- Participate in platform changes, releases, migrations, and modernization efforts using documented change-management and testing practices.

- Follow and improve runbooks for platform incidents, data-source outages, ingestion failures, d