SIEM Platform Engineer (f/m/d) @ A1 Competence Delivery Center

Strength. Care. Growth

A1 Competence Delivery Center is a vital component of A1’s telecommunications business. Acting as an expertise hub, CDC is dedicated to delivering a full range of high-quality IT, network, financial and other services to support A1’s operations across all OpCos, independent of location.

Using the power of being OneGroup and leveraging synergies, CDC enables transparency of resources, key skills and knowledge expansion and personal career growth opportunities’ enhancement, paired with job stability.

You will know we are the right place for you, if you are driven by:

• Opportunities to learn and build your career.
• Meaningful work in a stable and fast-paced company.
• Diversity of people, projects, and platforms.
• A supportive, fun, and inspiring place to work.

Role Overview

As a SIEM Platform Engineer, you will be responsible for engineering, maintaining, and continuously improving our enterprise SIEM platform.

Your work will directly support our security operations by ensuring a reliable, scalable, and high‑quality SIEM foundation.

This is a hands‑on engineering position - not a SOC analyst role.

Role insights

• Maintain and improve Splunk Enterprise components (Search Heads, Indexers, Cluster Masters, Deployment Servers).
• Manage and optimize heavy forwarders and universal forwarders for reliable log ingestion.
• Onboard new data sources across cloud, on-prem, and hybrid environments.
• Develop and maintain TAs, props/transforms, field extractions, and parsing logic.
• Ensure CIM-compliant data models and well-structured, high-quality logs.
• Support troubleshooting across ingestion, parsing, indexing, search performance, and configuration issues.
• Ensure platform stability, performance, and security.
• Handle platform upgrades, scaling activities, and architecture enhancements.
• Work with internal teams to document integrations and maintain onboarding quality.
• Work closely with SOC analysts, threat hunters, and detection engineers to ensure data readiness.
• Contribute to internal engineering standards, guidelines, and best practices.
• Automate deployments, maintenance tasks, and data onboarding workflows (Python, Bash, Ansible, or similar).
• Build scripts and tools that improve the platform’s efficiency and reduce manual work.
• Support SOAR automation pipelines where needed.

What makes you unique

• Bachelor’s or Master’s degree in Information Security, Computer Science, or related field.
• 3–5+ years of hands‑on experience administering and engineering Splunk Enterprise/SIEM platforms.
• Strong hands-on experience with Splunk Enterprise as a platform engineer/admin.
• Expertise in: Deployment servers, Heavy forwarders, Parsing and filtering, TA/APP development, Data onboarding at scale.
• Solid understanding of: Linux, Networking fundamentals, Logging architectures.
• Scripting skills (Python preferred).
• Experience in cybersecurity/SIEM environments.
• Familiarity with cloud environments (especially Azure/M365) is a plus.
• Splunk certifications (Admin, Architect, Core, ES Analyst) are a strong advantage.
• German language skills will be considered as an advantage.

Our gratitude for the job done will be eternal, but we’ll also offer you:

• Valuable experience in one of the fastest-growing and most innovative industries.
• Challenging assignments with strong opportunities for personal and professional growth in a multinational environment.
• Hybrid working model supporting a healthy work-life balance.
• Thousands of online and in-person Learning opportunities for you to grow.
• Modern, open, and friendly work environment that fosters continuous learning and the development of both technical and soft skills.
• Special employee tariffs and a wide range of attractive employee benefits.

If you have any questions, please do not hesitate to contact

Svetlina Vazharova.