SIEM Platform Engineer v Praha, Česko

We are looking for a SIEM Platform Engineer to design, operate, and continuously improve enterprise security logging and monitoring capabilities. The role ensures reliable, high-quality telemetry for threat detection, incident response, digital forensics, and compliance, while optimizing platform performance, scalability, and cost.

The role follows a hybrid working model, with three days per week based in the office (Tuesday, Wednesday, Thursday).

Engineer, configure, maintain, and monitor the SIEM platform, collectors, connectors, and supporting infrastructure Onboard security-relevant logs from identity, endpoint, network, cloud, business applications, databases, and other environments Design reliable data pipelines; develop parsing, normalization, transformation, timestamp handling, and contextual enrichment Monitor telemetry health and resolve missing sources, ingestion delays, volume anomalies, schema changes, and connector failures Support detection engineering with required fields, correlation logic, threat intelligence, MITRE ATT&CK mapping, and testing Optimize ingestion, storage tiers, retention, query performance, licensing, and cost without reducing required security visibility Maintain architecture diagrams, log-source inventory, onboarding standards, runbooks, ownership, and configuration records Support SOC investigations, threat hunting, incident response, forensic data extraction, audits, and major incident resolution Coordinate logging requirements and remediation with IT, Cloud, Network, IAM, Application, OT, vendors, and service providers Practical experience in SIEM engineering, security monitoring, log management, or security platform engineering Hands-on expertise with an enterprise SIEM, preferably Microsoft Sentinel; Splunk, QRadar, Elastic, or Google SecOps are also relevant Experience with log onboarding and troubleshooting across Windows, Linux, Microsoft Entra ID, cloud, network, endpoint, and application environments Proficiency in KQL/SPL/SQL, or a comparable query language, including analytics and performance troubleshooting Knowledge of syslog, APIs, agents, collectors, event streaming, common schemas, parsing, normalization, and enrichment Scripting or automation experience using PowerShell, Python, REST APIs, Git, CI/CD, or infrastructure-as-code Understanding of detection engineering, incident response, digital forensics, networking, security controls, and data protection Strong analytical, documentation, stakeholder communication, and end-to-end ownership skills; professional English required SIEM and security data lake architecture; SOAR and detection-as-code practices Experience in regulated, critical-infrastructure, energy, or OT environments Knowledge of NIS2, ISO/IEC 27001, IEC 62443, and security log retention requirements Relevant Microsoft, Splunk, GIAC, CISSP, CISM, or equivalent certification