SIEM Content Engineer

About the role

Kyndryl is looking for a SIEM Content Engineer to design, configure and maintain XDR/SIEM/SOAR solutions across on‑premise and cloud environments. You will develop use cases, dashboards and incident‑response playbooks while collaborating with SOC analysts, threat intel and hunting teams.

Key responsibilities

• Develop and implement use cases, dashboards, notebooks and runbooks for XDR/SIEM/SOAR platforms (IBM, Microsoft, Palo Alto).
• Design, configure and support SIEM/SOAR deployments, including event and flow pipelines, threat detection rules, and data classification.
• Collaborate with cross‑functional security teams to ensure detection mechanisms are effective and aligned with business objectives.
• Monitor content performance, troubleshoot issues and continuously improve based on the evolving threat landscape.

Required profile

• Strong programming experience in Python, PHP, Bash or PowerShell.
• Proficiency with blue‑team tooling (SIEM, SOAR, EDR/XDR) and familiarity with the MITRE ATT&CK framework.
• Solid understanding of networking, operating systems and security concepts.
• Excellent verbal and written English communication skills.

Required skills

• Python, PHP, Bash, PowerShell
• SIEM, SOAR, EDR/XDR platforms
• MITRE ATT&CK framework
• KQL, AQL, XQL query languages