🇬🇧
The English-language job board for Spain
89,000+ live jobsSIEM and SOAR Integration Engineer
Remote, Madrid·Full-time·Added today (last checked 4 Nov)
Our summary
- Work mode
- Remote (Madrid)
- Contract
- Full-time
- English
- Required
- Experience
- 2+ years
- Education
- University degree
Visa options
The ad doesn’t mention sponsorship
No sponsorship mentioned, and this kind of work is rarely sponsored in Spain.
Skills
Nice to have
This job advert was originally written in Spanish.
Requirements
What we're looking for
- University degree in Computer Engineering, Software Engineering, Telecommunications, or similar (or demonstrable equivalent experience).
- 2–4 years of experience in cybersecurity, ideally in a SOC or MSSP, with hands-on work in SIEM and SOAR.
- Hands-on experience with at least one market SIEM/SOAR: Google SecOps (Chronicle), Palo Alto Cortex XSIAM/XSOAR, Splunk, QRadar, or Microsoft Sentinel.
- Development of detection rules and parsers (YARA-L, SPL, AQL, KQL, or equivalent).
- Solid programming skills in Python and REST API consumption (authentication, pagination, error handling). Bash or JavaScript/TypeScript is a plus.
- Knowledge of common log sources (Windows, Active Directory, firewalls, VPN, Office 365) and MITRE ATT&CK.
- Experience integrating EDR/XDR via API (CrowdStrike, Cortex XDR, Sophos, Cybereason, Defender, or others).
- Version control with Git and notions of CI/CD (GitHub or GitLab). • English B2 or higher (technical documentation and clients), and Spanish; Catalan is a plus.
Languages
English B2
The role
We are looking for a SIEM and SOAR Integrations Engineer to connect log sources, security platforms, and automated response workflows within a SOC.
What you'll do
- Integrate new log sources into the SIEM (firewalls, WAF, VPN, Windows, Active Directory, Office 365, Google Workspace, EDR, and cloud services) through collectors, parsers, and field mapping.
- Design, develop, and maintain integrations and playbooks in the SOAR using third-party APIs (EDR, threat intelligence, ticketing, email, identity).
- Automate triage, enrichment, and alert response to reduce manual workload and SOC response times.
- Create, tune, and document correlation rules and use cases aligned with MITRE ATT&CK, reducing false positives.
- Execute the technical part of client onboarding: initial deployment, connectivity, log collection, and detection validation.
- Monitor the health of integrations and ingestion, and resolve incidents involving connectors, APIs, and parsers.
- Document integrations, playbooks, and procedures, and train SOC analysts on their use.
- Collaborate with analysts, IT teams, and clients, translating security needs into technical solutions.
- Contribute to the SOC's detection and automation strategy and to code versioning (Git, CI/CD). Essential requirements
How you'll work
8x5 schedule from Mon-Fri, primarily remote work except for occasional office attendance when necessary.
About DEVOTEAM
Devoteam is a global IT consulting and digital transformation company headquartered in Levallois-Perret, France. With over 10,000 employees across more than 20 countries, Devoteam helps organizations leverage technology, particularly cloud platforms like Google Cloud, AWS, and Azure, to drive innovation and business growth. The company operates in multiple sectors, offering services in cloud engineering, cybersecurity, data analytics, and identity management.
In Spain, Devoteam has a significant presence with offices in Madrid and Barcelona, and many roles are offered with remote or hybrid work options. The company is known for its strong partnerships with major cloud providers and its focus on digital transformation. For international professionals, Devoteam offers opportunities to work on cutting-edge projects in a multicultural environment, with many positions requiring English proficiency and offering the possibility of fully remote work.
- Founded
- 1995
- Employees
- 10,000–15,000
- Headquarters
- Levallois-Perret, France
- In Spain
- Madrid, Barcelona
Good to know if you are moving
- Devoteam has offices in Madrid and Barcelona, with many roles offering 100% remote work across Spain.
- The company is a Google Cloud Premier Partner, offering opportunities to work on cutting-edge cloud projects.
- Many positions require English proficiency, making it accessible for international professionals.
- Devoteam provides a multicultural work environment with employees from various countries.
- The company offers career development programs and certifications in cloud and cybersecurity.
In their own words
About the company & team
Devoteam is a leading European consultancy focused on digital strategy, technology platforms, cybersecurity, and business transformation through technology.
Technology is in our DNA, and we believe in it as a lever capable of driving change for the better, maintaining a balance that allows us to offer our client portfolio top-tier technological tools, but always with the closeness and professionalism of a team that acts as a guide along the way.
Devoteam has been committed to technology serving people for over 30 years. With more than 10,000 people in the group, across 20 countries in Europe, the Middle East, and Africa.
More jobs like this
or browse Madrid·Security·Security·Mid-level·Remote·Cybersecurity·Community of Madrid
🇬🇧
🇬🇧
🇬🇧
🇬🇧
🇬🇧
🇬🇧
🇬🇧
🇬🇧
🇬🇧