C

Center for Internet Security

Promotes cybersecurity best practices and benchmarks

Principal SIEM Engineer

Full-TimeUpdated on 10/23/2026
$128.6k - $225k
Expert
Bachelor's, Master's
Remote in USA
Remote
CybersecuritySecurity Operations & Incident Response

About the job

Requirements
  • A bachelor's degree in Information Technology, Cybersecurity, or a related field is required; additional relevant experience or an Associate's degree or equivalent combined with relevant experience may substitute.
  • At least 7 years of experience deploying, engineering, and operating enterprise security monitoring and logging platforms, including log source onboarding, parsing, and detection content development.
  • At least 7 years of experience in security operations or security engineering directly supporting a security operations center.
  • At least 5 years of experience building production SOAR automation, including case management content, escalation playbooks, and integrations with ticketing systems and third-party APIs.
  • Demonstrated experience troubleshooting an end-to-end log pipeline, from collector or relay through parsing and enrichment to the analyst's alert or case, and resolving faults rather than escalating them.
  • Experience serving as a technical escalation point and managing platform vendor escalations, including assessing whether a vendor-supplied fix is safe to deploy.
  • Experience using or producing Cyber Threat Intelligence designed for network defense.
  • Willingness to participate in an after-hours on-call rotation for the platform.
  • Experience analyzing data collected by security tools, including firewall, intrusion detection and prevention systems, data loss prevention, endpoint security tools, host-based logs, network logs, syslog, and other data sources.
  • Proficiency in security log data enrichment processes and sources, including significant operational experience with regular expressions, SQL, Python, and analytic techniques.
  • Experience with network forensics and tools such as Wireshark, PCAP, tcpdump, and the MITRE ATT&CK framework.
  • Experience with cloud technologies and providers such as Amazon, Azure, and Google.
  • Must be authorized to work in the United States.
  • Solid organizational skills, including attention to detail and multitasking.
Responsibilities
  • Develop and maintain SOAR content, including case management configuration, escalation playbooks, and automations; author and version playbook templates, including bulk escalation templates across source types such as CrowdStrike and Albert, and coordinate changes with SOC leadership before deployment.
  • Configure and maintain the SIEM, including building and joining relays to the SIEM, tagging log sources, configuring regular expressions, validating parsing, and defining alerts.
  • Build and tune detection content across monitored sources, including Suricata, CrowdStrike, Albert, and third-party endpoint, firewall, and network telemetry.
  • Troubleshoot the ingestion and case-creation pipeline end to end and serve as the platform's tier 2 escalation point, owning ingestion failures, playbook logic errors, data discrepancies between third-party portals and SOAR case data, and undocumented error types through resolution.
  • Participate in platform incident response, including the tier 2 after-hours on-call rotation, and maintain the associated alerting and routing.
  • Manage technical escalations with the SIEM and SOAR vendor as CIS's contact for severity cases; diagnose vendor-side defects and regressions, assess vendor fixes for safety, and design remediation when a fix is unsafe.
  • Deliver engineering steps for CIS Managed Detection and Response and SOC-as-a-service customer onboarding, including use case verification, onboarding guide development, relay build and SIEM joining, log collection verification, tag and regular-expression configuration, parsing validation with the vendor, alert definitions, SOAR case automation, SOC user acceptance testing, and health monitoring.
  • Build connector and log source integrations and automate repeatable buildout across Windows and Unix host logs, network devices and firewalls, VPN and remote access, identity and authentication systems, email security, and managed service provider collectors.
  • Manage, develop, and tune queries, alerts, inputs, and scripts integrating the cyber defense offerings and supporting operations infrastructure.
  • Build operational and customer-facing reports and dashboards from SIEM and SOAR data, including dashboards that draw live case data from SOAR tables.
  • Audit ingest volume against contractual limits and re-engineer source volume and filtering to keep daily ingest within the contracted cap.
  • Maintain platform documentation, including tiered escalation runbooks, onboarding guides, and log source documentation.
  • Provide technical input to Product and leadership decisions about the SIEM and SOAR platform, including vendor renewal discussions covering ingest ceilings, licensing models, and platform capability.
  • Perform other assigned tasks and responsibilities.
Desired Qualifications
  • Advanced degree in Computer Science, Business, or a related field.
  • Hands-on experience with SIEM and SOAR platforms.
  • Experience onboarding customers to managed detection and response or SOC-as-a-service offerings, log source by log source.
  • Experience building relays or log collectors and joining them to a SIEM, including TLS termination and client-side collection configuration.
  • Experience developing detection content for network intrusion detection, endpoint detection and response, or firewall telemetry.
  • Experience managing ingest volume against a contracted licensing or volume ceiling.
  • Experience mentoring engineers and cross-training peers on a SIEM or SOAR platform.
  • Strong presentation capabilities.
  • Relevant industry certifications such as CISSP, GCIH, GCIA, or GMON.
  • Experience in incident response, vulnerability management, and security operations.
  • Experience in vendor management and relationships.
  • Familiarity with Agile DevOps and project management.
  • Strong knowledge of scripting languages such as Python and PowerShell.
  • Solid client-facing and internal communication skills.

About the company

C

Center for Internet Security

View
Website

The Center for Internet Security (CIS) is a nonprofit organization that helps make the online world safer. It does this by creating widely used security guides, including CIS Controls (a set of prioritized actions to improve cybersecurity) and CIS Benchmarks (step-by-step configuration standards for IT systems). These standards are developed through a global, community-driven process and are used by private businesses, public organizations, and government entities. CIS also offers services and partnerships, a membership model, and a collaborative platform called CIS WorkBench where cybersecurity professionals network and share best practices. Unlike many for-profit vendors, CIS focuses on open, consensus-based standards and community collaboration rather than selling proprietary software alone. Its goal is to build confidence in the connected world by reducing cyber threats and helping organizations implement effective security measures.

Company Size

501-1,000

Company Stage

Early VC

Total Funding

$1.7M

Headquarters

Town of East Greenbush, New York

Founded

2000

Get referred to Center for Internet Security

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • September 3, 2026 OpenAI pilot expands CIS into AI defense for SLTT governments.
  • April 15, 2026 AWS Marketplace launch sells hardened AI and HPC images.
  • September 21, 2026 CDM v3.0 quantifies IG1 coverage across five attack classes.

What critics are saying

  • September 30, 2025 ended CISA support; MS-ISAC now depends on paid memberships.
  • State and local agencies face free CISA tools, shrinking willingness to pay CIS.
  • If SLTT churn rises in 2026, CIS loses its core mission and revenue engine.

What makes Center for Internet Security unique

  • CIS Controls and Benchmarks remain the default hardening language for enterprises and governments.
  • MS-ISAC gives CIS unmatched state and local government distribution and telemetry.
  • CIS Hardened Images and CDM v3.0 turn standards into deployable defenses.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Health Insurance
  • Dental Insurance
  • Vision Insurance
  • Unlimited Paid Time Off
  • Flexible Work Hours
  • Remote Work Options
  • Paid Vacation
  • Paid Holidays
  • 401(k) Retirement Plan
  • 401(k) Company Match
  • Stock Options
  • Company Equity

Growth & Insights and Company News

6 month growth

0%

1 year growth

0%

2 year growth

3%
Associated Press
Oct 23rd, 2026
CIS SecureSuite adds Cybersecurity Journey roadmap, Action1 integration and CIS Benchmarks access

The Center for Internet Security (CIS) has added new capabilities to its CIS SecureSuite Platform to help organisations understand their cybersecurity posture and set priorities. They are available now to SecureSuite members. The headline feature, Cybersecurity Journey, turns completed CIS Critical Security Controls assessments into an interactive roadmap. It gives posture scores aligned to the six functions of the NIST Cybersecurity Framework (CSF), prioritised actions, and visual reports for technical teams and executives. It uses existing assessment data, so no extra data entry is needed. A new integrations framework launches with support for Action1, an endpoint management and vulnerability remediation platform. Users can see managed devices, known vulnerabilities, missing updates, and remediation progress within SecureSuite. Members can also access the latest CIS Benchmarks from CIS WorkBench in PDF, Excel, SCAP, and ZIP formats. Other additions include CSV exports, faster reporting views, and policy templates.

Center for Internet Security
Sep 21st, 2026
CIS launches updated Community Defense Model.

CIS launches updated Community Defense Model. New analysis identifies the safeguards that provide the greatest security value against today's most prevalent attacks CLIFTON PARK, N.Y., Sept. 21, 2026 - The Center for Internet Security, Inc. (CIS(R) today announced the release of the CIS Community Defense Model (CDM) v3.0, the latest version of its data-driven framework that helps enterprises prioritize cybersecurity actions based on real-world threats. Built on attack data, threat intelligence, and MITRE ATT&CK(R) mappings, CDM v3.0 helps enterprises identify which CIS Critical Security Controls(R)(CIS Controls(R) Safeguards provide the greatest defensive value against the attacks they are most likely to face. The CIS Community Defense Model is grounded in the principle of collective defense, recognizing that enterprises often face similar cyber threats and can benefit from shared defensive knowledge. By connecting real-world attacker behavior directly to the CIS Controls, CDM v3.0 provides practical, data-driven guidance that helps enterprises reduce risk, strengthen cyber resilience, and maximize the impact of their cybersecurity investments. "Enterprises continue to face difficult decisions about where to focus limited cybersecurity resources," said Curt Dukes, Executive Vice President and General Manager of Security Best Practices at CIS. "CDM v3.0 helps defenders cut through the noise by identifying the actions that will have the greatest security value against today's most prevalent threats." Among its key findings, CDM v3.0 reinforces the value of Implementation Group 1 (IG1) of the CIS Controls, also known as essential cyber hygiene. The analysis found that enterprises implementing IG1 can achieve coverage against: * 89% of System Intrusion techniques * 86% of Social Engineering techniques * 88% of Basic Web Application Attack techniques * 84% of Privilege Misuse techniques * 88% of Denial of Service (DoS) techniques These findings demonstrate that a relatively small set of prioritized cybersecurity actions can provide broad protection against today's most common attack types and reinforce CIS guidance that every enterprise should start with essential cyber hygiene. The analysis also found that enterprises implementing all CIS Controls Safeguards can defend against 99% to 100% of techniques used across the five attack categories studied, further validating the CIS Controls as an effective foundation for modern cyber defense. New in this release, the CIS Controls Active Defense Lifecycle(TM) provides a defender-focused capability that reinforces the value of layered defense and understanding where safeguards can disrupt attacker activity before impact occurs. By aligning safeguards to stages of attacker behavior, enterprises can identify defensive strengths, uncover potential gaps, and strengthen defense-in-depth strategies. CDM v3.0 also identified CIS Safeguard 4.1: Establish and Maintain a Secure Configuration Process as the most effective individual safeguard across all five attack categories, reinforcing the critical role of secure configuration as a foundation for cyber defense. The report further concludes that while artificial intelligence is increasing the speed, scale, and accessibility of cyber attacks, foundational cybersecurity practices continue to provide effective protection against many AI-enabled attack paths. Ultimately, CDM v3.0 helps enterprises answer one of cybersecurity's most pressing questions: What should Center for Internet Security, Inc. do first? By identifying the CIS Safeguards that provide the greatest security value against real-world threats, the model transforms threat intelligence into prioritized, actionable defense strategies. The CIS Community Defense Model (CDM) v3.0 is available now at www.cisecurity.org. About CIS: The Center for Internet Security, Inc. (CIS(R) makes the connected world a safer place for people, businesses, and governments through its core competencies of collaboration and innovation. Center for Internet Security, Inc. is a community-driven nonprofit, responsible for the CIS Critical Security Controls(R) and CIS Benchmarks(R), globally recognized best practices for securing IT systems and data. Center for Internet Security, Inc. lead a global community of IT professionals to continuously evolve these standards and provide products and services to proactively safeguard against emerging threats. Its CIS Hardened Images(R) provide secure, on-demand, scalable computing environments in the cloud. CIS is home to the Multi-State Information Sharing and Analysis Center(R)(MS-ISAC(R), the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial government entities, and the Elections Infrastructure Information Sharing and Analysis Center(R)(EI-ISAC(R), which supports the rapidly changing cybersecurity needs of U.S. election offices. To learn more, visit or follow Center for Internet Security, Inc. on X: @CISecurity.

Associated Press
Sep 4th, 2026
CIS and OpenAI launch AI cyber defence pilot for US state and local governments

The Center for Internet Security, in collaboration with OpenAI, has launched an AI Cyber Defense Pilot to help US state, local, tribal, and territorial governments strengthen cybersecurity. The initiative will bring together government and critical infrastructure organisations to examine how AI can address real-world cybersecurity challenges. The pilot programme will evaluate AI's potential to help organisations detect risks faster, prioritise security actions, and improve cyber readiness. Participating organisations will leverage OpenAI's technology to identify and validate findings, support remediation efforts, and advance cybersecurity best practices. The initiative aims to produce implementation guidance and recommendations to inform future adoption of AI-powered cybersecurity capabilities across the public sector. CIS and OpenAI seek to identify practical approaches that can help defenders reduce risk and better protect essential services.

Today in New York
Sep 4th, 2026
Center for Internet Security launches AI Cyber Defense Pilot to strengthen state and local government cybersecurity.

Center for Internet Security launches AI Cyber Defense Pilot to strengthen state and local government cybersecurity. CIS and MS-ISAC collaboration with OpenAI will explore how AI can strengthen the cyber defense, resilience, and threat response of U.S. critical infrastructure At a time when defenders at the state and local government level are challenged by a growing threat landscape, AI has the potential to be a game changer." - Brian Calkin, Chief Technology and Innovation Officer at CIS CLIFTON PARK, NY, UNITED STATES, September 4, 2026 /EINPresswire.com/ - The Center for Internet Security, Inc. (CIS), in collaboration with OpenAI, today announced an AI Cyber Defense Pilot designed to help U.S. State, Local, Tribal, and Territorial (SLTT) governments and critical infrastructure organizations harness the power of artificial intelligence to enhance cybersecurity and resilience. As cyber threats become more sophisticated and widespread, foreign adversaries continue to target the nation's critical infrastructure. At the same time, many public sector organizations and critical infrastructure operators must defend increasingly complex environments with limited resources. The initiative will bring together government and critical infrastructure organizations, including members of the MS-ISAC community, of varying sizes, regions, and cybersecurity maturity levels to examine how AI can be applied to real-world cybersecurity challenges. The pilot program will evaluate AI's potential to help organizations detect risks faster, better prioritize security actions, strengthen cyber hygiene, and improve overall cyber readiness. "The services Americans rely on every day are increasingly in the crosshairs of cyber threats. At a time when defenders at the state and local government level are challenged by a growing threat landscape, AI has the potential to be a game changer," said Brian Calkin, Chief Technology and Innovation Officer at CIS. "This pilot will help us understand how AI can help organizations make smarter decisions, respond faster, and focus on the risks that matter most. The lessons we learn can help strengthen cyber resilience for communities across the country." The effort will be informed by the operational experience and cybersecurity expertise of the MS-ISAC community, which works daily to help SLTT governments prevent, detect, respond to, and recover from cyber incidents. That perspective will help ensure the pilot focuses on real-world challenges facing public sector defenders. Participating state and local organizations will leverage OpenAI's technology to help identify, validate, and prioritize findings, support remediation efforts, and advance cybersecurity best practices aligned with the CIS Critical Security Controls(R) and essential cyber hygiene criteria. "We have a defender's window: a narrowing opportunity to use frontier AI to close security gaps before attackers seize them. Our partnership with CIS and the MS-ISAC is about making sure that opportunity reaches the defenders protecting essential services - including smaller and under-resourced teams - with the tools, training, and support to use AI for stronger defenses," said Sasha Baker, Head of National Security Policy at OpenAI. "What we learn from this pilot can help extend those capabilities to communities across the country, so that Americans everywhere are better protected from emerging cyber threats." In addition to supporting pilot participants, the initiative will produce implementation guidance, lessons learned, and recommendations to inform future adoption of AI-powered cybersecurity capabilities across the public sector and critical infrastructure community. Together, CIS and OpenAI aim to identify practical, scalable approaches that can help defenders reduce risk, improve resilience, and better protect the essential services Americans rely on every day. The pilot reflects CIS's broader commitment to helping SLTT government organizations navigate the opportunities and challenges presented by artificial intelligence. As AI becomes increasingly integrated into government and critical infrastructure operations, organizations must balance innovation with a risk-based approach to security, transparency, resilience, and accountability. Through its growing body of AI security resources, research, and best practices, CIS is providing practical guidance on secure AI adoption, governance, and emerging threats, helping organizations build confidence in the responsible use of AI. Additional resources on security artificial intelligence are available at cisecurity.org/topics/securing-artificial-intelligence. For additional information or media inquiries, please contact CIS Senior Media Relations Manager, Kelly Wyland, at [email protected]. About CIS: The Center for Internet Security, Inc. (CIS(R) makes the connected world a safer place for people, businesses, and governments through its core competencies of collaboration and innovation. Today in New York is a community-driven nonprofit, responsible for the CIS Critical Security Controls(R) and CIS Benchmarks(TM), globally recognized best practices for securing IT systems and data. Today in New York lead a global community of IT professionals to continuously evolve these standards and provide products and services to proactively safeguard against emerging threats. Its CIS Hardened Images(R) provide secure, on-demand, scalable computing environments in the cloud. CIS is home to the Multi-State Information Sharing and Analysis Center(R)(MS-ISAC(R), the trusted resource for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial government entities. To learn more, visit cisecurity.org or follow Today in New York on X: @CISecurity. About MS-ISAC: The Multi-State Information Sharing and Analysis Center(R)(MS-ISAC(R) is the trusted nationwide network for cyber threat prevention, protection, response, and recovery for U.S. State, Local, Tribal, and Territorial (SLTT) governments. The mission of the MS-ISAC is to improve the overall cybersecurity posture of the nation's SLTT governments through coordination, collaboration, cooperation, and increased communication. The MS-ISAC is a division of the Center for Internet Security(R)(CIS(R), a 501(c)(3) nonprofit. Visit MS-ISAC or email [email protected] for more information. Kelly Wyland Center for Internet Security +1 518-256-6978 email Today in New York here Visit Today in New York on social media: LinkedIn Instagram Facebook YouTube X Legal Disclaimer: EIN Presswire provides this news content "as is" without warranty of any kind. Today in New York do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.

Center for Internet Security
Jul 28th, 2026
CIS named among Top Workplaces of the Capital Region.

CIS named among Top Workplaces of the Capital Region. July 28, 2026. The Center for Internet Security has once again been named one of the Capital Region's Top Workplaces by the Albany Times Union. CIS received a special award for Work/Life Flexibility, with one employee reporting "I have the flexibility I need to balance my work and personal life."