Lead SIEM Engineer

Lead SIEM Engineer
Hybrid – Hemel Hempstead (1–2 days per week on-site)
Security Clearance: Eligible & willing to obtain DV
 
This role is for SIEM specialists
A great opportunity for a  Lead SOC SIEM Engineer to take ownership of detection engineering within a large, rapidly scaling SOC that protects some of the UK’s most sensitive defence and national security environments.
 
The SIEM Engineer will sit at the intersection of threat intelligence, telemetry, and detection logic, shaping how threats are identified, prioritised, and acted upon across multiple high-security clients. If you’re passionate about SIEM content quality, signal over noise, and building detections that actually work, this role gives you real authority to do that
 
The focus of the Lead SIEM Engineer role will be:

Owning the SIEM content lifecycle  from concept and design through build, tuning, and continuous optimisation
Engineering high-fidelity detections, dashboards, and reporting that SOC analysts trust
Ensuring data ingestion, parsing, and enrichment deliver coverage, context, and visibility
Turning threat intelligence, vulnerabilities, and attacker TTPs into actionable detection logic
Reducing false positives while improving alert confidence and response speed
Acting as the technical bridge between SOC analysts, architects, engineers, and delivery teams
Helping define detection standards, engineering patterns, and best practice across the SOC 
This role could be for you if your SIEM experience covers:

Strong hands-on SIEM engineering experience with Splunk, Microsoft Sentinel, QRadar, or similar
Deep understanding of detection engineering, use-case development, and monitoring strategy
Confidence working with security frameworks and standards (NIST, ISO 27001/27002, CIS, PCI DSS)
Scripting capability in Python, PowerShell, regex (automation mindset preferred)
Comfortable supporting multiple customers and environments without losing engineering quality
Willing and eligible to obtain DV clearance 
This is a true SIEM content leadership role, not an escalation or firefighting position, defending country critical technology and clients. A chance for a Senior SIEM professional to join a SOC that’s scaling.
 
If you care about signal quality, detection depth, and SIEM done properly, this is where your work will matter.

If you are interested please apply ASAP. The People Network is an employment agency and will respond to all applicants within three - five working days. If you do not hear within these timescales please feel free to get in touch