SIEM/SOC Engineer

***Why this role exists*** Teslm is establishing its central SIEM/SOC capability and needs one hands-on engineer to own it end to end. You will decide how the pipeline is assembled, bring the log sources in, write the detections and run the daily triage — working directly with the CEO & CISO. If you have built or run a SIEM with your own hands and want the whole thing to be your responsibility, this is that role. ***About the role*** 12 months in, success looks like this: every relevant log source from our AWS environment and our applications is onboarded, normalised into a common schema and reported healthy every month; a focused set of priority detections is live and tuned so that the alert queue can be trusted; the triage workflow (alert → investigate → contain → document → close or escalate) is documented in runbooks that an L1 Analyst can follow; log retention and an immutable archive are in place; and the evidence an auditor asks for under PCI DSS v4 Requirement 10, PDPL, NCA ECC-2:2024 and ISO/IEC 27001 A.8.15 and A.8.16 can be produced on request. You will also give day-to-day technical direction to an L1 SOC Analyst. We are deliberately not fixed on a vendor. You may build Wazuh from scratch, monitor and maintain CrowdStrike, or work with a Wazuh service provider — we are hiring for general SIEM competence, not for a product. ***What you'll do*** • Own log-source onboarding: CloudTrail, GuardDuty and Security Hub findings, infrastructure logs and application security events, each parsed into a common schema. • Own the detection set: write, version and tune a small number of high-value rules mapped to our top risks, and review false positives every week. • Own the health of every log source — spot silent gaps before an auditor or an attacker does. • Own daily triage and containment: investigate related events by host, user and IP, contain with a second pair of eyes before any destructive production action, and document every case. • Own retention and evidence: an immutable log archive, retention aligned to our compliance obligations, and quarterly evidence packs. • Own the runbooks, saved queries and escalation path the L1 SOC Analyst works from, and set that analyst's daily priorities. ***Required*** • 2–4 years of hands-on SIEM/SOC work in which you personally onboarded log sources, wrote or tuned detection rules, and triaged the resulting alerts. • You have built or maintained a SIEM yourself — Wazuh, Elastic, Splunk, CrowdStrike or similar — and can explain the design choices you made. • Working knowledge of AWS security logging: CloudTrail, GuardDuty and Security Hub, and how their events end up in a SIEM. • Comfortable with log parsing and normalisation, query languages, and Linux administration for the components you run. • Able to write clear runbooks and incident documentation. • This is a hands-on practitioner role, not an architect or leadership position — you will build and run the tooling yourself, working directly with the CEO & CISO. If you are looking for a team to manage, this is not the right fit. ***Nice to have*** • CompTIA Security+ or CySA+ • AWS Certified Security – Specialty • Wazuh, Elastic or Splunk vendor training • GIAC certifications (GCIA, GCIH or GMON) • Experience with file-integrity monitoring, vulnerability detection or PCI DSS dashboards inside a SIEM ***Details*** • Location: Makkah, Saudi Arabia — on-site • Employment: full-time, permanent, start as soon as possible • Reports to: the CEO & CISO • Scope: Teslm's AWS environment and applications • International candidates are welcome to apply. ***How to apply*** Apply via LinkedIn.