Customer SIEM Engineer

Gravwell

13h•$120,000 - $210,000•Remote

About The Position

Gravwell is seeking a highly technical Customer SIEM Engineer to facilitate our Mission Support and onboarding efforts. While the Sales Engineers win the heart of the customer, you are the one who makes the platform fly. You will take the baton from the pre-sales team to lead customers through deployment, configuration, and long-term technical success. As a bridge between sales and engineering, you’ll ensure that every Gravwell instance is tuned for maximum visibility and elite performance.

Requirements

3–5+ years in a highly technical role such as Security Engineer, SIEM Administrator, or Site Reliability Engineer (SRE).
Linux Power User: You should be comfortable living in the terminal. Deep knowledge of Linux internals, file systems, and performance tuning is a must.
Scripting & Automation: Proficiency in Shell scripting, Python, or Powershell for system management and tasks.
Detection Mindset: Strong understanding of security frameworks (MITRE ATT&CK) and the ability to translate TTPs into functional search queries and alerts.
Log Mastery: Experience with regex, JSON manipulation, and structured/unstructured data normalization.
SIEM Expertise: Hands-on experience managing or deploying enterprise-grade platforms (e.g., Splunk, Elastic, QRadar, or specialized syslog-ng/fluentd architectures).
Project Leadership: Ability to manage an onboarding timeline and guide multiple stakeholders through a technical mission.

Nice To Haves

Experience with various virtualization and storage architectures.
Knowledge of network protocols (PCAP analysis, Netflow, IPFIX).
Certifications in Security (GCIA, GCIH, OSCP) or Linux (RHCSA/RHCE).

Responsibilities

Lead the Onboarding Journey: Take full technical ownership of the customer relationship immediately following the sale, moving them from initial setup to a fully operational production environment.
Architect Data Pipelines: Design and implement complex data ingestion strategies using Gravwell Ingesters, focusing on efficient normalization and parsing.
Detection Engineering: Collaborate with customer security teams to build, test, and deploy advanced queries and alerting logic to identify threats and system anomalies.
Systems Engineering: Provide expert-level guidance on Linux system tuning, storage optimization, and resource management to ensure Gravwell clusters perform at peak efficiency.
Mission Support: Act as the primary technical point of contact for complex troubleshooting, helping customers navigate deep-tier technical hurdles in their environments.
Develop Technical Tooling: Write custom shell scripts, utilities, and automation workflows to streamline deployment and data manipulation tasks.
Feedback Loop: Act as a conduit between the customer and our core Engineering team, translating real-world usage challenges into prioritized product features.