Hybrid SEIM/SOAR Engineer

at Arctiq

• Job title: SEIM/SOAR Engineer
• Job type: Full Time
• Experience level: Mid level, Senior
• Salary: Not specified
• Degree requirement: Professional Certificate
• Tech skills: AWS, Azure, Cloud, Cyber Security, Firewalls, Python, Splunk
• Location requirements: Hybrid, Montreal, Canada

About the role

• Bilingual SIEM/SOAR Engineer in Managed Security Services team deploying and optimizing security tools for diverse clients. Responsible for building detection use cases and automating response playbooks.

Responsibilities

• Deploy, configure, and maintain SIEM platforms (e.g., Palo Alto XSIAM, Splunk, Sentinel) for MSSP clients
• Onboard new log sources and ensure full visibility across cloud, endpoint, network, and application layers
• Develop custom parsers, normalization rules, and enrichment workflows
• Build and maintain automated playbooks for incident triage, enrichment, and response using platforms like Cortex XSOAR, SecOps SOAR or Splunk SOAR
• Integrate SOAR with threat intelligence, ticketing systems, firewalls, EDRs, and other customer tools
• Continuously improve automation coverage to reduce analyst workload and response times
• Collaborate with SOC analysts and threat hunters to design and implement detection use cases based on MITRE ATT&CK, threat intel, and client risk profiles
• Tune detection rules to reduce false positives and ensure actionable alerts
• Serve as a technical expert for MSSP clients during onboarding, tuning sessions, and ongoing support
• Provide recommendations for SIEM/SOAR improvements, architecture changes, and operational efficiencies
• Assist with incident response investigations where tooling configuration or custom queries are required
• Maintain detailed documentation of configurations, playbooks, and processes
• Train internal SOC teams and client stakeholders on SIEM/SOAR workflows and usage
• Stay abreast of advancements in SIEM and SOAR technologies, incorporating new capabilities into hunting and detection workflows

Requirements

• Fully bilingual English and French
• 3+ years of experience working with SIEM and/or SOAR platforms in a security operations or MSSP setting
• Hands-on experience with at least one major SIEM (e.g., Palo Alto XSIAM, Splunk, Sentinel)
• Experience with SOAR platforms and playbook development (e.g., Cortex XSOAR, SecOps SOAR, Splunk SOAR)
• Strong scripting and automation skills (e.g., Python, PowerShell, Bash, REST APIs)
• Proficiency with log formats and parsing (Syslog, JSON, Windows Events, CEF, etc.)
• Knowledge of detection logic development using query languages (e.g., SPL, KQL, regex, Sigma)
• Solid understanding of cybersecurity concepts, frameworks, and methodologies (MITRE ATT&CK, cyber kill chain)
• Experience integrating threat intelligence into SIEM/SOAR platforms
• Strong documentation and communication skills, especially with client stakeholders
• Ability to manage multiple clients and projects in a fast-paced, service-oriented environment
• Experience in an MSSP or MDR environment is a plus.
• Certifications such as Palo Alto XSOAR Engineer, Splunk Certified Admin, Azure SC-200, GCIH, Security+, or CISSP preferred
• Experience with cloud logging (AWS CloudTrail, Azure Monitor, Google Chronicle) is a plus.

Benefits

• Equal opportunity employer
• Inclusive work environment
• Accommodations available for interview process