About this role
Salary: £? - ? per year
Requirements: Strong hands-on experience with IBM QRadar SIEMExperience developing, maintaining, and tuning SIEM rules and correlation searchesGood understanding of security logging, log sources, and event normalisationExperience with log aggregation and forwarding technologiesExperience working with SOC teams and supporting security monitoring operationsDesirable: experience with Fluentd, Cribl, or Fluent BitDesirable: exposure to Splunk SIEM and migration projectsDesirable: scripting experience using Python, Bash, or similarDesirable: experience onboarding new log sources and troubleshooting ingestion pipelines Responsibilities: Own, maintain, and tune IBM QRadar SIEM rules, correlation logic, and alertsReview and optimise detection use cases to improve threat visibility and reduce false positivesConfigure and maintain log collection, parsing, normalisation, and aggregationSupport log aggregation using Fluentd, Cribl, or similar technologiesEnsure relevant security logs are accurately ingested and available to the third-party SOCTroubleshoot log ingestion, parsing, and SIEM detection issuesIdentify opportunities to improve SIEM coverage, logging quality, and detection capabilitiesSupport planning for a potential migration from QRadar to Splunk Technologies: BashIBMSupportPythonSecuritySplunk More:
We are seeking a hands-on Security Engineer for a six-month contract to own and optimise SIEM rules, alert tuning, and log aggregation, primarily in IBM QRadar. The role focuses on improving threat detection and ensuring high-quality security logs are available to a third-party SOC, with potential support for a future migration to Splunk. The position is based in London, with one day per week onsite in Central London and remote working otherwise.
last updated 42 week of 2026