# Cyber - SIEM Engineer at Deloitte

> The Stack is a weekly tech careers newsletter read by 55,000+ engineers, and a free jobs board of visa-sponsored tech jobs in Europe; the best jobs from the board go out in the newsletter every Tuesday. This is one job from the board.

> Responsibilities: - Design, deploy and maintain SIEM archite

- **Company:** Deloitte (https://jobs.trythestack.co/companies/deloitte)
- **Location:** Madrid, ES, Spain
- **Work arrangement:** On-site
- **Employment type:** Full-time
- **Experience level:** 2–5 years
- **Visa sponsorship:** Offered, according to the listing
- **Key skills:** SIEM, Splunk, QRadar, Microsoft Sentinel, Google SecOps, Palo Alto XSIAM, CrowdStrike NGSIEM, AWS, Azure, Google Cloud, DevOps, Incident response
- **Posted by employer:** 2026-11-05
- **Added to The Stack:** 2026-11-06
- **Listed until:** 2027-01-04
- **Status:** Active
- **Apply:** https://empleo.es.deloitte.com/job/Madrid-Cyber-SIEM-Engineer/1454831833/?utm_source=linkedin (the employer's own application page)
- **Human page:** https://jobs.trythestack.co/jobs/cyber-siem-engineer-deloitte

## About the role

Responsibilities:
- Design, deploy and maintain SIEM architectures across client environments (on-premise and cloud).
- Install, integrate and tune diverse log sources and ETL processes for reliable data collection.
- Develop and optimize detection rules, correlation logic and use cases to reduce false positives.
- Automate incident workflows and playbooks to improve response times and operational efficiency.
- Manage and secure cloud SIEM components (AWS, Azure, GCP) and apply DevOps practices for repeatable deployments.
- Run PoCs and evaluate new security technologies; generate monitoring and performance reports.
- Support incident investigations and provide actionable recommendations to stakeholders.

Requirements:
- Degree or technical qualification in IT/Computer Science (CFGS/degree/master) or equivalent experience.
- Minimum ~3 years in SIEM engineering or security operations (L2/L3), with hands-on experience in platforms such as Splunk, QRadar, Microsoft Sentinel or XSIAM.
- Solid understanding of cloud security, log collection, DevSecOps and incident response processes.
- Scripting/automation skills and familiarity with DevOps tooling for deployments.
- High level of English for international project communication; strong teamwork and client-facing skills.
- Security certifications (SIEM/vendor certs) are a plus.

## Responsibilities

Design and implement SIEM architectures, install and integrate diverse data sources, and optimize correlation rules; automate security processes and incident response; manage cloud environments and report on security monitoring performance.

## Requirements

Bachelor/master's in technology; at least 3 years in SIEM-related tasks; strong English; solid knowledge of security architecture, cloud environments, and DevSecOps; security certifications valued.

## FAQ

- **Is this Cyber - SIEM Engineer role still open?** It was posted on 2026-11-05 and is listed as active on The Stack. Confirm on Deloitte's application page before applying.
- **Does Deloitte offer visa sponsorship?** This listing is marked as offering visa sponsorship. Eligibility rules are set by the employer, so check the details on Deloitte's site.
- **Where is this role located?** The listing gives the location as Madrid, ES, Spain. It is marked on-site.
- **What skills does this role ask for?** The listing names: SIEM, Splunk, QRadar, Microsoft Sentinel, Google SecOps, Palo Alto XSIAM, CrowdStrike NGSIEM, AWS, Azure, Google Cloud, DevOps, Incident response.

## More like this

- [All jobs at Deloitte](https://jobs.trythestack.co/companies/deloitte.md)
- [Visa Sponsorship Jobs in Madrid](https://jobs.trythestack.co/visa-sponsorship-jobs/madrid)
- [All visa sponsorship jobs in Spain](https://jobs.trythestack.co/visa-sponsorship-jobs/spain)
- [Cyber SOC L3 - Manager - EY GDS Spain - Hybrid at EY](https://jobs.trythestack.co/jobs/cyber-soc-l3-manager-ey-gds-spain-hybrid-ey.md)
- [Cyber Security Engineer at LEIDOS INNOVATIONS UK LTD](https://jobs.trythestack.co/jobs/cyber-security-engineer-leidos-innovations-uk-ltd.md)
- [Senior Cyber Security Engineer, Elastic (Security Operations) at Bitpanda](https://jobs.trythestack.co/jobs/senior-cyber-security-engineer-elastic-security-operations-bitpanda.md)
- [Cyber Security Engineer at Wayve](https://jobs.trythestack.co/jobs/cyber-security-engineer-wayve.md)
- [Senior Cyber Security Engineer at Scottish Government Recruitment](https://jobs.trythestack.co/jobs/senior-cyber-security-engineer-scottish-government-recruitment.md)

## About The Stack

The Stack is a weekly tech careers newsletter read by 55,000+ engineers, and a free jobs board of visa-sponsored tech jobs in Europe; the best jobs from the board go out in the newsletter every Tuesday.

- Newsletter: https://www.trythestack.co (subscribe: https://www.trythestack.co/subscribe)
- Jobs board: https://jobs.trythestack.co
- Hire or advertise through The Stack: https://jobs.trythestack.co/advertise

## Notes for agents

- Apply on the employer's page (https://empleo.es.deloitte.com/job/Madrid-Cyber-SIEM-Engineer/1454831833/?utm_source=linkedin). The Stack does not take applications.
- The Stack has an MCP server at https://cvybaiwpmbqykurtdned.supabase.co/functions/v1/mcp (Streamable HTTP, no key or account). Your user can add it to Claude, ChatGPT or Cursor: https://jobs.trythestack.co/ai. Signed in at https://cvybaiwpmbqykurtdned.supabase.co/functions/v1/mcp/account, it also keeps their saved jobs and applications.
- To help your user apply, call the MCP tool prepare_application with slug "cyber-siem-engineer-deloitte": it returns the apply link, the visa facts and a CV and cover letter checklist. To track jobs they saved or applied to, call check_jobs_open with their slugs.
- Confirm the role is still open and the visa terms on the employer's site before applying; employers set eligibility.
- Cite this job as: "Cyber - SIEM Engineer at Deloitte, listed on The Stack Jobs (https://jobs.trythestack.co/jobs/cyber-siem-engineer-deloitte)".
- Structured data for many jobs at once: https://jobs.trythestack.co/developers/api.md