SIEM Engineer

Stack

Responsibilities

• ▹Configure and maintain SIEM and Security Data Lake (SDL) components, including log collection, ingestion, parsing and normalization, following established designs and standards
• ▹Monitor the health and performance of assigned SIEM and SDL components, troubleshoot common issues, document findings and escalate complex or high-impact problems
• ▹Implement and test log source integrations and configuration changes based on defined technical requirements and approved procedures
• ▹Validate log data quality, and develop and tune detection rules, dashboards and reports based on documented requirements or identified gaps
• ▹Support incident investigations and operational coordination by providing relevant SIEM data and working with source owners or support teams
• ▹Maintain documentation and support audits, while identifying recurring issues and recommending practical improvements to procedures, configurations and monitoring

Requirements

• ▹Master's degree with 1 to 2 years of experience in Information Systems or a related field, OR Bachelor's degree with 2 to 3 years, OR Diploma with 3 to 4 years
• ▹Proven understanding of common security monitoring and detection engineering practices
• ▹In-depth knowledge of cybersecurity frameworks, technologies and best practices
• ▹Strong knowledge of security architecture frameworks and principles
• ▹Excellent analytical and problem-solving skills
• ▹Strong verbal and written communication skills in English
• ▹Ability to work effectively with global, virtual teams

Nice to have

• ▹Proficiency with deploying and running log collection infrastructure (e.g. Splunk Universal Forwarder, Fluentd, Cribl), SIEM solutions (e.g. QRadar, Elastic, ArcSight, Sentinel) and Security Datalake solutions (e.g. Snowflake-based, AWS-based)
• ▹Experience with network security, endpoint protection and incident response
• ▹Proficiency in scripting and automation (e.g., Python, Bash)
• ▹Experience deploying, running and monitoring cloud-hosted infrastructure
• ▹Experience developing, deploying and managing AI agents (agentic systems), including integrating them with APIs, data sources and automation workflows
• ▹Certifications: GCDA, GSEC, CompTIA Security+, CISSP (preferred)

Soft skills

What we offer

• ▹Comprehensive AMGEN Total Rewards Plan with healthcare, finance and well-being benefits
• ▹Hybrid work model with time split between the Lisbon office and remote work
• ▹Access to certifications, trainings, mentorship and career mobility
• ▹Modern cloud-first, automation-focused, AI-powered tech stack
• ▹Global scale collaboration in nimble, agile teams

About the company

AMGEN's capability center in Portugal is based in Lisbon, with over 500 people from more than 40 nationalities. It supports the company's mission to serve patients through technology and digital innovation.