Security Engineer (SIEM Expert)

We are seeking a highly skilled SIEM (Security Information and Event Management) Expert to join our cybersecurity team. The ideal candidate will be responsible for architecting, installing, and managing SIEM solutions to ensure the security and integrity of our systems.

The Company

Headquartered in Tallahassee, FL, Mainline is an IT solutions provider serving clients across the United States and across industries. With acquired knowledge and earned trust, we offer expertise and experience to our clients at a local level, with the backing of a national, highly skilled organization. Mainline has leveraged its technical data center expertise, diverse partner network, and consultative customer-centric approach to become a leading provider of enterprise server, hybrid cloud, cyber storage, and network & security solutions.

Founded in 1989, Mainline offers over 30 years of experience to over 2500 customers. With over 400+ IT professionals and $1b in revenue, we act as an independent advisor to find the best solution for our clients' business needs and strategy. Mainline partners with industry-leading solution providers and has over 1000 technical and sales certifications, including accreditation by the International Enterprise Architecture Institute (iEAi) and the CRN Tech Elite 250.

Job Overview

We are seeking a highly skilled SIEM (Security Information and Event Management) Expert to join our cybersecurity team. The ideal candidate will be responsible for architecting, installing, and managing SIEM solutions to ensure the security and integrity of our systems. This role requires deep expertise with Splunk, and experience with QRadar and XSIAM is highly preferred. Candidates local to Columbia, SC, and those holding relevant certifications will be given strong preference.

The SIEM Expert will play a critical role in designing and maintaining robust security monitoring systems, analyzing threats, and ensuring seamless integration with existing infrastructure. If you are a proactive problem-solver with a passion for cybersecurity, we want to hear from you!

Key Responsibilities

• Architecture & Design: Design and architect SIEM solutions tailored to organizational needs, ensuring scalability, performance, and security best practices.
• Installation & Configuration: Install, configure, and deploy SIEM platforms, including Splunk (required), and ideally QRadar and XSIAM, to monitor and protect systems.
• Management & Optimization: Manage day-to-day operations of SIEM systems, including log ingestion, log parsing, correlation rules, dashboards, and alerting mechanisms.
• Threat Detection & Response: Develop and fine-tune use cases, queries, and rules to identify security incidents and respond effectively to threats.
• Integration: Integrate SIEM tools with other security and IT systems, such as firewalls, endpoint protection, and ticketing platforms.
• Maintenance: Perform regular updates, patch management, and performance tuning to ensure SIEM systems remain reliable and effective.
• Documentation: Create and maintain detailed documentation for SIEM configurations, processes, and incident response procedures.
• Collaboration: Work closely with IT, security, and compliance teams to align SIEM capabilities with organizational goals and regulatory requirements.
• Training & Mentorship: Provide guidance and training to junior team members on SIEM tools and best practices.

Required Qualifications

• Experience:
  
  
  
  • Minimum of 5+ years of experience in cybersecurity, with at least 3 years focused on SIEM architecture, installation, and management.
  • Proven hands-on experience with Splunk (required), including deployment, configuration, and administration.
  
  
  
  
• Technical Skills:
  
  
  
  • Expertise in log management, event correlation, and creating custom dashboards and reports.
  • Strong understanding of network security, system administration, and cybersecurity principles.
  • Proficiency in scripting languages (e.g., Python, PowerShell) for automation and customization.
  • Knowledge of cloud environments (AWS, Azure, etc.) and their integration with SIEM tools.
  
  
  
  
• Analytical Skills: Ability to analyze large datasets, parse logs effectively, identify patterns, and troubleshoot complex performance issues within SIEM environments.
• Communication: Excellent verbal and written communication skills to collaborate with technical and non-technical stakeholders.

Preferred Qualifications

• Certifications:
  
  
  
  • Splunk certifications (e.g., Splunk Certified Power User, Splunk Certified Admin, or Splunk Enterprise Certified Architect) are highly preferred.
  • QRadar certifications (e.g., IBM QRadar SIEM Administrator) are a strong plus.
  • XSIAM experience or certifications (e.g., Palo Alto Networks certifications) are highly desirable.
  • Other relevant certifications such as any GIAC, CISSP, or CEH are a bonus.
  
  
  
  
• Experience:
  
  
  
  • Hands-on experience with IBM QRadar and/or Palo Alto XSIAM is highly preferred.
  • Familiarity with additional SIEM platforms (e.g., ArcSight, Elastic, LogRhythm) is a plus.
  
  
  
  
• Location: Candidates based in or near Columbia, SC, are strongly preferred.

Additional Skills & Competencies

• Strong problem-solving skills and attention to detail.
• Ability to work independently and manage multiple priorities in a fast-paced environment.
• Proactive approach to staying updated on the latest cybersecurity trends, threats, and SIEM advancements.

Environmental Factors and Physical Requirements

This is a hybrid position. Candidates located within the United States will be considered, with preference given to Columbia, SC

• Physical environmental factors of this position include those found in typical business office environment or home office environment.
• Requires use of general office equipment and personal computer equipment.
• Ability to travel. Various means of travel may be required, including auto and air travel. This position requires travel: Rarely
• May be required to work irregular schedules including but not limited to as applicable: Nights, weekends, holidays, on-call, and/or overtime.

Why Mainline?

With an average employee tenure of 12+ years, our people are passionate about IT, loyal to our customers, and excellent to each other. As a 99% work-from-home company, we leverage technology to build relationships, grow our skillsets, and stay connected with each other and our clients. At Mainline, we encourage every employee to continue learning through technical certifications or classes, and to keep pushing the boundaries of what IT solutions we can offer our customers in this ever-changing technology industry. If you identify with staying up to date on the latest tech, bringing out of the box ideas to the table, and joining a team of smart, enthusiastic, and dedicated people - apply now!

Benefits Overview: https://mainline.jobs/benefits/

How Do You Stack Up?

At Mainline, we are dedicated to building a diverse and inclusive workplace, so if you're excited about this role but your resume doesn't align perfectly with every qualification in the job description, we encourage you to apply anyway.

EEO/AA Employer/Vet/Disabled