Manager - SIEM and Threat Intelligence

The role is responsible for managing and enhancing the organization’s security monitoring, log management, Security Information and Event Management (SIEM), and threat intelligence capabilities. The role focuses on collecting, integrating, normalizing, correlating, and analyzing security logs from multiple IT and security infrastructure components, including servers, network devices, applications, firewalls, endpoint protection systems, intrusion detection and prevention systems (IDS/IPS), and other security solutions. He/she ensures comprehensive security visibility across the IT environment, enables timely detection of cyber threats, supports incident investigation and response, and strengthens the organization’s overall security posture through proactive threat intelligence and continuous monitoring.

• Manage centralized log collection from servers, networks, applications, firewalls, endpoint protection systems, and other security tools.
• Ensure proper log integration, normalization, retention, and monitoring through the SIEM platform.
• Develop and maintain security alerts, correlation rules, dashboards, and threat detection use cases.
• Monitor security events, investigate suspicious activities, and coordinate incident response.
• Collect and analyze threat intelligence to identify emerging threats and indicators of compromise.
• Integrate threat intelligence feeds into SIEM and other security solutions.
• Ensure security logging and monitoring comply with organizational policies and regulatory requirements.
• Coordinate with IT Infrastructure, Network, Application Operations, and SOC teams to resolve logging and monitoring issues.
• Maintain SIEM documentation, operational reports, and security monitoring KPIs.
• Continuously improve security monitoring coverage and threat detection capabilities.
• Perform any other duties assigned to by line manager related to the nature of the work
• Enforce, incorporate, and comply with all necessary controls and related information security policies, procedures, practices, training, reporting, personal due diligence and vigilance, within departmental/unit activities and operations. 

Preferred Qualifications

• A tertiary-level qualification from a recognized institution in Cybersecurity, Information Technology, Computer Science, or a related field.
• Relevant certifications such as CISSP, CISM, or vendor-specific SIEM certifications are preferred

Years & Nature of Experience

• 5+ years of equivalent experience in in SIEM, security monitoring, or cybersecurity operations.
• Experience with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, or equivalent.
• Strong knowledge of log collection, security event analysis, threat intelligence, and incident response.

Technical Competencies 

• SIEM and centralized log management.
• Log source integration and troubleshooting.
• Threat intelligence and threat detection.
• Security incident investigation.

Behavioral Competencies

• Decision Making 
• Communication 
• Stakeholder management
• Problem solving