Remote SIEM Engineer Jobs
Remote SIEM Engineer jobs are open across cybersecurity, financial services, healthcare, and government contracting at remote-first firms, managed security service providers, and distributed enterprise security teams, from mid-level analysts to senior engineers and architects. Employers hiring remotely right now include Proficio, Huntress Labs, and PingWind. Find a role that fits below and apply directly.
Find Remote SIEM Engineer JobsOverview
Showing 5 of 6+ Remote SIEM Engineer jobs
Summit Technologies, Inc. is seeking a SIEM Engineer to support our government client in enterprise cybersecurity operations and the modernization of the agency's security monitoring and analytics capabilities. In this role, you will administer, engineer, maintain, and optimize enterprise Security Information and Event Management (SIEM) platforms within a mission-critical federal environment. The ideal candidate will have extensive hands-on SIEM administration and engineering experience, strong knowledge of enterprise logging architectures, and the ability to troubleshoot complex technical issues while designing and implementing scalable, reliable security monitoring solutions.
The successful candidate will contribute to SIEM architecture and modernization initiatives, including the migration from Splunk to Elastic, while improving platform performance, data ingestion, security visibility, and detection capabilities. Strong analytical skills, technical initiative, accountability, and commitment to continuous improvement are essential.
This is a full-time, hybrid position requiring on-site work three (3) days per week and remote work two (2) days per week. Candidates must be U.S. citizens and eligible to obtain and maintain a U.S. Public Trust clearance.
Duties and Responsibilities
- Administer, maintain, engineer, and optimize enterprise SIEM platforms, including Splunk Enterprise, Splunk Enterprise Security (ES), and Elastic / Elastic Security, ensuring platform availability, performance, reliability, and scalability.
- Support SIEM architecture and modernization initiatives, including the transition from Splunk to Elastic, migration of data sources and security use cases, infrastructure design, testing, validation, and operational cutover.
- Design, configure, manage, and troubleshoot enterprise log collection and ingestion pipelines, including syslog, Windows Event Collection and Forwarding, SIEM agents and forwarders, network devices, security technologies, applications, databases, and cloud services.
- Onboard and normalize security telemetry, ensuring accurate data collection, parsing, enrichment, indexing, retention, and searchability using applicable standards such as Splunk Common Information Model (CIM) and Elastic Common Schema (ECS).
- Develop, maintain, migrate, and optimize SIEM searches, dashboards, reports, alerts, correlation rules, and security detections using SPL, SQL, and Elastic query technologies.
- Monitor and optimize SIEM infrastructure health, data ingestion performance, storage utilization, system capacity, and data availability while supporting high availability, disaster recovery, and scalability requirements.
- Troubleshoot complex SIEM and logging issues across the complete data collection and ingestion pipeline, identify root causes, and implement sustainable solutions to improve platform reliability and operational effectiveness.
- Support SIEM architecture, configuration management, security hardening, change control, automation, and platform lifecycle management in accordance with enterprise and federal requirements.
- Collaborate with security analysts, infrastructure teams, application owners, and cybersecurity leadership to improve security visibility, detection capabilities, data quality, and operational reporting.
- Develop and maintain technical documentation, including architecture diagrams, data flow diagrams, configuration standards, standard operating procedures (SOPs), and migration procedures.
- Provide technical guidance and knowledge sharing to team members while supporting enterprise SIEM engineering and operational activities.
- Evaluate emerging SIEM technologies and capabilities, identify opportunities for engineering improvements, and recommend solutions that enhance performance, automation, scalability, and operational efficiency.
- Take ownership of assigned technical initiatives, communicate project progress and risks, and independently drive complex technical issues and projects through resolution.
Required Experience and Skills
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline; or equivalent relevant IT and cybersecurity experience, subject to client requirements.
- At least nine (9) years of relevant IT or cybersecurity experience, including a minimum of three (3) years of hands-on SIEM administration, engineering, or enterprise logging experience.
- Demonstrated experience administering, engineering, configuring, and troubleshooting enterprise SIEM platforms, including hands-on experience with Splunk Enterprise and working knowledge of Elastic or comparable search and analytics technologies.
- Strong understanding of SIEM architecture, distributed systems, enterprise logging, data ingestion, parsing, normalization, indexing, data retention, and performance optimization.
- Proficiency in Splunk Search Processing Language (SPL), working knowledge of SQL, and familiarity with Elastic query technologies such as KQL, ES|QL, EQL, or Query DSL.
- Experience onboarding and troubleshooting enterprise data sources, including Windows and Linux systems, network devices, security appliances, applications, and cloud environments.
- Strong Linux and Windows administration skills, including working knowledge of networking, TCP/IP, DNS, HTTP/HTTPS, TLS, syslog, and related protocols.
- Experience with scripting and automation using Python, PowerShell, Bash, REST APIs, or comparable technologies.
- Familiarity with enterprise cybersecurity technologies, including Endpoint Detection and Response (EDR), firewalls, IDS/IPS, identity systems, vulnerability management, and security monitoring platforms.
- Demonstrated ability to independently investigate complex technical problems, analyze data, identify root causes, and develop practical engineering solutions.
- Strong technical curiosity, initiative, accountability, and the ability to learn new technologies while adapting to evolving enterprise requirements.
- Excellent written and verbal communication skills, including the ability to document technical solutions and collaborate effectively with technical teams and leadership.
Strongly Desired
- Hands-on experience with Elastic Stack / Elastic Security, including Elasticsearch, Kibana, Elastic Agent/Fleet, Beats, Logstash, and Elastic query technologies.
- Experience with distributed or cloud-based SIEM architectures, including clustering, high availability, disaster recovery, storage optimization, and capacity planning.
- Experience supporting enterprise SIEM migrations, particularly Splunk-to-Elastic migrations, including data source migration, detection migration, and operational validation.
- Advanced experience with Splunk Enterprise and Splunk ES, including distributed architectures, CIM, search optimization, and platform administration.
- Experience with security detection engineering, correlation rules, alert tuning, MITRE ATT&CK, and security analytics development.
- Familiarity with configuration management, Infrastructure as Code (IaC), Git, CI/CD, and automated platform deployments.
- Experience supporting cybersecurity operations within federal environments and familiarity with NIST, FISMA, OMB, and FedRAMP requirements.
- Relevant technical certifications, such as Splunk Enterprise Certified Admin, Splunk Enterprise Certified Architect, Elastic Certified Engineer, Security+, CISSP, or comparable certifications.
Education
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline; or
- Equivalent relevant IT or cybersecurity experience may be substituted in lieu of a degree, subject to client requirements.
Security Clearance
- Candidates must be U.S. citizens and eligible to obtain and maintain a U.S. Public Trust clearance.
- Candidates must meet the client's applicable eligibility and background investigation requirements.
Application Instructions
If you feel you are qualified and want to be considered for this position, please submit the following information to fue9wcom651qpxxjb6a8ynnuwa@crelate.net, and include job number 6945 in the subject line:
- Updated resume, including MM/YYYY dates for each employer.
- Best dates and times for an interview, along with the phone number where you can be reached.
- Availability to start once a formal offer is received.
Summit Technologies, Inc. is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by applicable law.
Summit Technologies, Inc. is seeking a SIEM Engineer to support our government client in enterprise cybersecurity operations and the modernization of the agency's security monitoring and analytics capabilities. In this role, you will administer, engineer, maintain, and optimize enterprise Security Information and Event Management (SIEM) platforms within a mission-critical federal environment. The ideal candidate will have extensive hands-on SIEM administration and engineering experience, strong knowledge of enterprise logging architectures, and the ability to troubleshoot complex technical issues while designing and implementing scalable, reliable security monitoring solutions.
The successful candidate will contribute to SIEM architecture and modernization initiatives, including the migration from Splunk to Elastic, while improving platform performance, data ingestion, security visibility, and detection capabilities. Strong analytical skills, technical initiative, accountability, and commitment to continuous improvement are essential.
This is a full-time, hybrid position requiring on-site work three (3) days per week and remote work two (2) days per week. Candidates must be U.S. citizens and eligible to obtain and maintain a U.S. Public Trust clearance.
Duties and Responsibilities
- Administer, maintain, engineer, and optimize enterprise SIEM platforms, including Splunk Enterprise, Splunk Enterprise Security (ES), and Elastic / Elastic Security, ensuring platform availability, performance, reliability, and scalability.
- Support SIEM architecture and modernization initiatives, including the transition from Splunk to Elastic, migration of data sources and security use cases, infrastructure design, testing, validation, and operational cutover.
- Design, configure, manage, and troubleshoot enterprise log collection and ingestion pipelines, including syslog, Windows Event Collection and Forwarding, SIEM agents and forwarders, network devices, security technologies, applications, databases, and cloud services.
- Onboard and normalize security telemetry, ensuring accurate data collection, parsing, enrichment, indexing, retention, and searchability using applicable standards such as Splunk Common Information Model (CIM) and Elastic Common Schema (ECS).
- Develop, maintain, migrate, and optimize SIEM searches, dashboards, reports, alerts, correlation rules, and security detections using SPL, SQL, and Elastic query technologies.
- Monitor and optimize SIEM infrastructure health, data ingestion performance, storage utilization, system capacity, and data availability while supporting high availability, disaster recovery, and scalability requirements.
- Troubleshoot complex SIEM and logging issues across the complete data collection and ingestion pipeline, identify root causes, and implement sustainable solutions to improve platform reliability and operational effectiveness.
- Support SIEM architecture, configuration management, security hardening, change control, automation, and platform lifecycle management in accordance with enterprise and federal requirements.
- Collaborate with security analysts, infrastructure teams, application owners, and cybersecurity leadership to improve security visibility, detection capabilities, data quality, and operational reporting.
- Develop and maintain technical documentation, including architecture diagrams, data flow diagrams, configuration standards, standard operating procedures (SOPs), and migration procedures.
- Provide technical guidance and knowledge sharing to team members while supporting enterprise SIEM engineering and operational activities.
- Evaluate emerging SIEM technologies and capabilities, identify opportunities for engineering improvements, and recommend solutions that enhance performance, automation, scalability, and operational efficiency.
- Take ownership of assigned technical initiatives, communicate project progress and risks, and independently drive complex technical issues and projects through resolution.
Required Experience and Skills
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline; or equivalent relevant IT and cybersecurity experience, subject to client requirements.
- At least nine (9) years of relevant IT or cybersecurity experience, including a minimum of three (3) years of hands-on SIEM administration, engineering, or enterprise logging experience.
- Demonstrated experience administering, engineering, configuring, and troubleshooting enterprise SIEM platforms, including hands-on experience with Splunk Enterprise and working knowledge of Elastic or comparable search and analytics technologies.
- Strong understanding of SIEM architecture, distributed systems, enterprise logging, data ingestion, parsing, normalization, indexing, data retention, and performance optimization.
- Proficiency in Splunk Search Processing Language (SPL), working knowledge of SQL, and familiarity with Elastic query technologies such as KQL, ES|QL, EQL, or Query DSL.
- Experience onboarding and troubleshooting enterprise data sources, including Windows and Linux systems, network devices, security appliances, applications, and cloud environments.
- Strong Linux and Windows administration skills, including working knowledge of networking, TCP/IP, DNS, HTTP/HTTPS, TLS, syslog, and related protocols.
- Experience with scripting and automation using Python, PowerShell, Bash, REST APIs, or comparable technologies.
- Familiarity with enterprise cybersecurity technologies, including Endpoint Detection and Response (EDR), firewalls, IDS/IPS, identity systems, vulnerability management, and security monitoring platforms.
- Demonstrated ability to independently investigate complex technical problems, analyze data, identify root causes, and develop practical engineering solutions.
- Strong technical curiosity, initiative, accountability, and the ability to learn new technologies while adapting to evolving enterprise requirements.
- Excellent written and verbal communication skills, including the ability to document technical solutions and collaborate effectively with technical teams and leadership.
Strongly Desired
- Hands-on experience with Elastic Stack / Elastic Security, including Elasticsearch, Kibana, Elastic Agent/Fleet, Beats, Logstash, and Elastic query technologies.
- Experience with distributed or cloud-based SIEM architectures, including clustering, high availability, disaster recovery, storage optimization, and capacity planning.
- Experience supporting enterprise SIEM migrations, particularly Splunk-to-Elastic migrations, including data source migration, detection migration, and operational validation.
- Advanced experience with Splunk Enterprise and Splunk ES, including distributed architectures, CIM, search optimization, and platform administration.
- Experience with security detection engineering, correlation rules, alert tuning, MITRE ATT&CK, and security analytics development.
- Familiarity with configuration management, Infrastructure as Code (IaC), Git, CI/CD, and automated platform deployments.
- Experience supporting cybersecurity operations within federal environments and familiarity with NIST, FISMA, OMB, and FedRAMP requirements.
- Relevant technical certifications, such as Splunk Enterprise Certified Admin, Splunk Enterprise Certified Architect, Elastic Certified Engineer, Security+, CISSP, or comparable certifications.
Education
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical discipline; or
- Equivalent relevant IT or cybersecurity experience may be substituted in lieu of a degree, subject to client requirements.
Security Clearance
- Candidates must be U.S. citizens and eligible to obtain and maintain a U.S. Public Trust clearance.
- Candidates must meet the client's applicable eligibility and background investigation requirements.
Application Instructions
If you feel you are qualified and want to be considered for this position, please submit the following information to fue9wcom651qpxxjb6a8ynnuwa@crelate.net, and include job number 6945 in the subject line:
- Updated resume, including MM/YYYY dates for each employer.
- Best dates and times for an interview, along with the phone number where you can be reached.
- Availability to start once a formal offer is received.
Summit Technologies, Inc. is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by applicable law.
See All 6 Remote SIEM Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Remote SIEM Engineer JobsRemote SIEM Engineer Job Market
Who's Hiring
What Employers Look For
The qualifications that appear most often in remote SIEM engineer jobs.
- Three or more years of hands-on experience administering a SIEM platform such as Splunk, Microsoft Sentinel, or IBM QRadar
- Proven ability to write custom correlation rules, detection use cases, and query logic in SPL, KQL, or AQL
- Experience integrating log sources including endpoints, cloud services, firewalls, and identity providers into a SIEM environment
- Relevant certification such as Splunk Core Certified Power User, Microsoft SC-200, or CompTIA CySA+
- Familiarity with MITRE ATT&CK framework and its application to detection engineering and alert triage
- Bachelor's degree in computer science, information security, or a related field, or equivalent demonstrated experience
Tips for Your Remote SIEM Engineer Job Search
Apply early to remote roles that fit
Migrate Mate lists remote siem engineer openings from across the U.S. in one place, so you can find roles that match your stack and seniority and apply directly without sorting through unrelated postings.
Show async incident documentation in your portfolio
Remote SOC teams depend on written communication. Include write-ups of detection rules you built, incident timelines you documented, or SIEM use cases you developed in a home lab. Concrete written artifacts prove you can operate without in-person collaboration.
Target MSSP and remote-first security firms first
Managed security service providers and remote-first cybersecurity companies have built their entire operations around distributed teams, so they hire remote siem engineers consistently and onboard them more smoothly than traditional enterprises transitioning to remote work.
Prepare for async technical screens and take-home assessments
Remote siem engineer interviews often include take-home detection engineering exercises or written case studies instead of live whiteboard sessions. Practice writing clear, structured threat detection logic and investigation summaries you can submit asynchronously.
Remote SIEM Engineer Jobs: Frequently Asked Questions
How do I get a remote siem engineer job?
Remote siem engineer roles go to candidates who can demonstrate self-directed threat detection and investigation without in-person oversight. Remote employers screen for hands-on experience with platforms like Splunk, Microsoft Sentinel, or IBM QRadar, strong written communication for async incident documentation, and the ability to collaborate across distributed SOC teams. Certifications such as Splunk Core Certified User or CompTIA Security+ signal readiness, and a home lab or documented incident response cases give you a concrete edge.
Which companies hire remote siem engineers?
Employers currently hiring remote siem engineers include Proficio, Huntress Labs, and PingWind, per current remote listings on Migrate Mate as of November 2026. Remote siem engineer openings are concentrated at managed security service providers, remote-first cybersecurity firms, and large enterprises in financial services, healthcare, and government contracting that run distributed security operations centers.
Can you get a remote siem engineer job with no experience?
Yes, but remote entry-level siem engineer roles are harder to land because employers expect you to work independently from day one with minimal hand-holding. The companies most open to entry-level remote candidates are MSSPs and mid-size cybersecurity firms with structured onboarding. What opens the door is a demonstrated home lab, documented SIEM use cases you built yourself, and a certification like CompTIA Security+ or Splunk Core Certified User that proves practical tool familiarity.
Do you need a degree for remote siem engineer jobs?
Not always. Many remote employers weigh hands-on SIEM platform experience, security certifications, and a portfolio of real detection use cases more heavily than a four-year degree. Certifications from Splunk, Microsoft, or CompTIA carry significant weight, and candidates who can show documented incident response work or self-built detection rules consistently compete with degree holders for remote openings.
See All 6 Remote SIEM Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Remote SIEM Engineer Jobs