Senior SIEM Operations Engineer

Who is Volkswagen Financial Services? It's been more than 70 years since Volkswagen Financial Services AG financed the first Volkswagen vehicles in Germany in 1949. A lot has changed since then, but our core goal hasn't; ensuring we meet the mobility needs of the people. Volkswagen Financial Services today operates in 48 markets through its various subsidiaries, shareholdings, and joint ventures. Volkswagen Financial Services is the largest provider of automotive financial services worldwide. At VWFS Porto, we are proud to foster a gender-equal workplace, where diversity is celebrated, and every individual is provided with equal opportunities to thrive and succeed. What do we do? VWFS Porto is a VWFS AG IT hub, and the first outside Germany. Here we will establish a long-term Business & IT company. Our primary goal is to service all European markets in implementing and maintaining contract management systems and another IT projects in other areas. Our focus is on: Core systems, satellite systems (such as document management systems, collection systems) but also extends to integrations, data, and large project organizations. For this we seek a hands-on Senior SIEM Operations Engineer. Objectives: As a Senior SIEM Operations Engineer, your primary objective is to ensure stability, performance, and continuous improvement of the organization's SIEM environment and its supporting infrastructure. You will play a critical role in maintaining security visibility across the organization by managing log sources, optimizing system performance, and supporting incident response capabilities. In this role you will be responsible for: Operating and maintaining the current on-premises SIEM platform, including system updates, configuration changes, and hardware service coordination (remotely); Performing regular patching and vulnerability mitigation for SIEM infrastructure and auxiliary systems; Monitoring and maintaining backup systems and updating detection rules to ensure operational continuity; Supporting and maintaining auxiliary systems such as Git servers, rsyslog servers, and other Linux-based services; Participating in On-Call duty rotations to ensure 24/7 operational support; Managing approximately 23,000 log sources: Ensuring all log sources are active and sending correct data; Adding new log sources and decommissioning inactive ones; Verifying data parsing and normalization; Performing capacity planning and lifecycle management of all components; Analyzing, optimizing, and developing scripts in Python, Bash, or Perl to automate and enhance operations; Maintaining and improving protocol standards for logging; Defining what should be logged; Testing and rolling out updated standards across the environment; Coordinating daily operational activities within the SIEM team to ensure smooth execution of tasks and alignment with service expectations; Acting as a technical escalation point and mentoring junior and mid-level engineers to support their development and ensure knowledge transfer. We believe that the right profile for this job should have / be: Strong hands-on experience with SIEM platform administration and log source management (e.g., Splunk, Elastic, IBM QRadar); Proficient in Linux system administration and scripting (Python, Bash); Experience with automation tools and CI/CD pipelines; Exposure to Git and centralized logging systems like rsyslog; Comfortable working in a high-availability, security-focused environment; Analytical mindset with strong problem-solving skills; Excellent communication skills and a proactive, team-oriented attitude; ITIL Certification or equivalent qualification (Foundational knowledge in IT service management); Certification in at least one SIEM solution platform (e.g., Splunk, Elastic, IBM QRadar,) – (Mandatory); Linux Professional Certification Level 2 or Red Hat Certified Engineer (RHCE) - (Recommended); Cisco Certified Network Associate (CCNA) or equivalent entry-level networking certification - (Recommended). Nice to have / Considered a plus: Experience with IT Service Continuity Management (ITSCM) testing; Experience with SIEM tuning and rule optimization; Exposure to cloud-based logging and hybrid environments; Knowledge of security frameworks and compliance standards (e.g., ISO 27001, NIST). Qualifications: Bachelor’s or Master’s degree in IT, Business, or relevant field; Experience with Agile (Scrum, Kanban) and SDLC tools like Jira and Confluence; Knowledge of performance tuning and integration techniques; Knowledge of English, both written and verbal. What we Offer: Long-term contract; Competitive package including private health insurance, life insurance and meal allowance (pay by meal card); Bonuses and benefits depending on performance; Schooling allowance and pension scheme; Incredible and unique annual company events; Opportunity to work on an international project and be part of multicultural and multidisciplinary team; Solid performance evaluation and career management methodologies; Continuous training – technical and behavioral development.