Freelance SIEM Solution Engineer / Architect

Project overview

A German service provider, exclusively specialized in information security, is currently supporting a major bank in Abu Dhabi in managing a serious security incident. The assignment ranges from containment and forensic analysis to rebuilding the security organization.

As a Freelance SIEM Solution Engineer / Architect, you will build up the bank's attack detection. Your detection logic will be based on the real TTPs of an attacker who was already in the environment.

Responsibilities

What you bring:

• Conception and setup of SIEM/EDR-based attack detection during ongoing post-incident operations
• Derivation of detection use cases from the TTPs of the current incident and expansion of MITRE ATT&CK coverage
• Log source onboarding prioritized by attack path: Active Directory, Entra ID, EDR, Firewalls, Proxy, DNS, as well as core banking and payment transaction systems
• Architectural decisions on data pipelines, retention, scaling, and data storage requirements
• Development of SOAR playbooks for automating containment measures
• Close collaboration with Incident Response, Threat Hunting, and Governance
• Transition to stable SOC operations, including runbooks for analysts
• Completed university degree or vocational training with corresponding professional experience
• Several years of experience in the conception and setup of SIEM/EDR platforms as well as in detection engineering
• Practical experience with Microsoft Sentinel, Splunk, IBM QRadar, CrowdStrike Next-Gen SIEM, Elastic, or comparable technologies
• Confident use of KQL or SPL as well as Sigma rules
• Experience with high-volume log pipelines and parsing heterogeneous sources
• Profound understanding of common attack techniques in Windows and Active Directory environments
• Very good German and business-fluent English skills

Project details

• Start: ab sofort
• Remote: remote
• Location: Deutschland, Deutschland, DE
• Languages: German

Source notes

Are you interested? Then we look forward to receiving your application documents and are available for any questions in an initial conversation.

• Building up a bank's attack detection based on real attacker TTPs, not theoretical scenarios
• Full-time engagement over a project duration of 3 to 6 months
• Rotation model with two alternating teams: two weeks in Abu Dhabi, two weeks in Germany
• Full coverage of all travel expenses
• Option for permanent employment, including unlimited vacation