Job description:

Security Data & SIEM Engineer

Johnson Controls is looking for a Security Data & SIEM Engineer to strengthen security visibility across cloud and enterprise environments. In this role, you will help design, tune, and operate the security logging and SIEM capabilities that support threat detection, investigation, and response.

Role Overview

You will own key parts of the security data pipeline, including log onboarding, normalization, detection content, alert tuning, and integrations with operational workflows. This is a hands-on engineering role for someone who can work across security tooling, incident response, and cross-functional partners to improve the quality and usefulness of security telemetry.

Key Responsibilities

• Configure and maintain SIEM content, including log sources, parsing, correlation rules, dashboards, alerts, and reports.
• Ingest and normalize security events from cloud, endpoint, network, identity, and application sources.
• Tune detections to reduce noise, improve signal quality, and support timely response.
• Support security tooling across SIEM, vulnerability management, endpoint protection, and CSPM platforms.
• Integrate security alerts and workflows with ServiceNow, Jira, and related ticketing tools.
• Partner with threat detection, incident response, and platform teams to investigate events and improve coverage.
• Maintain documentation, runbooks, policies, and procedures for security tooling and integrations.
• Monitor tool health and data quality, and troubleshoot issues in ingestion, visibility, and alerting.
• Stay current on emerging threats, vulnerabilities, and security best practices.
• Mentor team members and share practical guidance on SIEM engineering and data analysis.

How You Will Do It

• You take ownership of security outcomes with accountability, integrity, and a strong focus on safe operations.
• You stay close to the work, remove friction for your customers, and focus on the logs, detections, and integrations that matter most.
• You use data, feedback, and root-cause analysis to improve detection quality and make the environment better every day.
• You collaborate across security, IT, and business teams, sharing knowledge and building trust to win as one team.
• You validate changes carefully, document your work clearly, and keep support teams informed so the environment remains reliable and easy to operate.

Qualifications

• Bachelor's degree in computer science, information security, engineering, or a related field, or equivalent experience.
• 5 to 10 years of experience in IT security, security operations, or security engineering.
• Hands-on experience with SIEM platforms such as Splunk, QRadar, ArcSight, or Logscale.
• Strong understanding of log management, detection engineering, alert tuning, and security event analysis.
• Experience onboarding and maintaining security telemetry from cloud, endpoint, network, identity, and application sources.
• Experience with vulnerability management tools such as Qualys, Tenable.io, or Rapid7.
• Experience with endpoint protection solutions such as CrowdStrike, Carbon Black, or SentinelOne.
• Experience working with CSPM tools such as Palo Alto Prisma, CrowdStrike CSPM, or Sophos Cloud Optix.
• Working knowledge of ServiceNow, Jira, or similar ticketing workflows.
• Strong troubleshooting, documentation, and communication skills.

Nice to Have

• Python or PowerShell scripting experience.
• Experience with Kubernetes security or cloud infrastructure security.
• Certifications such as CompTIA Security+, Splunk Certified User, Splunk Certified Power User, GSEC, CISSP, or CISM.
• Experience supporting SOAR or automation workflows.
• Familiarity with Linux, Windows, or macOS security data sources.