Security Data & SIEM Engineer

Overview

Johnson Controls is looking for a Security Data & SIEM Engineer to strengthen security visibility across cloud and enterprise environments, helping design, tune, and operate security logging and SIEM capabilities that support threat detection, investigation, and response.

What you'll do

• Configure and maintain SIEM content, including log sources, parsing, correlation rules, dashboards, alerts, and reports.
• Ingest and normalize security events from cloud, endpoint, network, identity, and application sources.
• Tune detections to reduce noise, improve signal quality, and support timely response.
• Support security tooling across SIEM, vulnerability management, endpoint protection, and CSPM platforms.
• Integrate security alerts and workflows with ServiceNow, Jira, and related ticketing tools.
• Partner with threat detection, incident response, and platform teams to investigate events and improve coverage.
• Maintain documentation, runbooks, policies, and procedures for security tooling and integrations.
• Monitor tool health and data quality, and troubleshoot issues in ingestion, visibility, and alerting.
• Stay current on emerging threats, vulnerabilities, and security best practices.
• Mentor team members and share practical guidance on SIEM engineering and data analysis.

What you'll need

• Bachelor's degree in computer science, information security, engineering, or a related field, or equivalent experience.
• 5 to 10 years of experience in IT security, security operations, or security engineering.
• Hands-on experience with SIEM platforms such as Splunk, QRadar, ArcSight, or Logscale.
• Strong understanding of log management, detection engineering, alert tuning, and security event analysis.
• Experience onboarding and maintaining security telemetry from cloud, endpoint, network, identity, and application sources.
• Experience with vulnerability management tools such as Qualys, Tenable.io, or Rapid7.
• Experience with endpoint protection solutions such as CrowdStrike, Carbon Black, or SentinelOne.
• Experience working with CSPM tools such as Palo Alto Prisma, CrowdStrike CSPM, or Sophos Cloud Optix.
• Working knowledge of ServiceNow, Jira, or similar ticketing workflows.
• Strong troubleshooting, documentation, and communication skills.

Nice to have

• Python or PowerShell scripting experience.
• Experience with Kubernetes security or cloud infrastructure security.
• Certifications such as CompTIA Security+, Splunk Certified User, Splunk Certified Power User, GSEC, CISSP, or CISM.
• Experience supporting SOAR or automation workflows.
• Familiarity with Linux, Windows, or macOS security data sources.