Required skills
- SIEM
- Exabeam
- Cribl Stream
- Log Source Integration
- Data Pipelines
- Log Parsing
- Data Normalization
- Security Use Cases
- Correlation Rules
- Microsoft Defender for Endpoint (MDE)
- AWS CloudWatch
- SAP Security Audit Logs
Nice to have:Windows Defender Application Control (WDAC)VMware vCenterIBM Db2 LUWLiquibase SecureSecurityBridgeCloud LoggingAWS Log Source IntegrationStorage InfrastructureApplication WhitelistingApplication ControlEndpoint SecuritySOC ProcessesSecurity MonitoringThreat DetectionTechnical Documentation
Languages: German
Job description
Seeking a SIEM Engineer to analyze log sources, configure log connections using Cribl Stream, develop data pipelines, integrate logs into Exabeam, and implement security use cases and correlation rules.
Responsibilities
Your know-how:
Contract type:
Contract
- Analysis of existing log sources, data formats, and transmission paths, as well as coordination with system administrators and SOC
- Conception and implementation of log connections via Cribl Stream, including configuration of Sources, Routes, and Destinations
- Development and optimization of pipelines for normalization, filtering, and enrichment of log data
- Integration of log data into Exabeam, as well as checking data quality and completeness
- Review of existing standard parsers, as well as development and testing of individual parsers
- Conception and implementation of security-relevant use cases and correlation rules in coordination with the SOC
- Execution of functional tests and optimization of detection rules to reduce false positives
- Documentation of all configurations and processes in Confluence, as well as handover to the SOC team
- Profound knowledge of SIEM systems, especially Exabeam and Cribl Stream
- Experience in connecting and integrating various log sources
- Knowledge in the development and optimization of log pipelines, parsing, and data normalization
- Experience in the conception and implementation of security use cases and correlation rules
- Knowledge of Microsoft Defender for Endpoint (MDE) and Windows Defender Application Control (WDAC)
- Experience with VMware vCenter and processing of virtualization logs
- Knowledge in database auditing, especially IBM Db2 LUW and Liquibase Secure
- Experience with SAP Security Audit Logs, ideally SecurityBridge
- Knowledge of AWS CloudWatch, cloud logging, and integration of AWS log sources
- Experience with storage infrastructures (NAS, SAN, S3, storage systems, and SAN switches)
- Knowledge in application whitelisting, application control, and endpoint security
- Experience in developing and customizing individual SIEM parsers
- Understanding of SOC processes, security monitoring, and threat detection
- Experience in technical documentation and handover of SIEM configurations to SOC teams
Project details
Hannover, remote
11/15/2026
12/31/2026
- Start: 2026-11
- Duration: 2 Monate
- Remote: hybrid
- Location: Hannover, Deutschland, DE
- Languages: German
Indexed by 9am's meta-search. You are a job provider? Claim or manage this listing
Found on FreelancerMap DE