Senior Associate SIEM Implementation

About the role

PwC Canada is hiring a Senior Associate SIEM Implementation in its cybersecurity advisory practice in Toronto. The role leads technical deliverables for SIEM implementation and operations, including Microsoft Sentinel, Google SecOps, Palo Alto XSIAM and Devo, and works closely with SOC, threat hunters, infrastructure and cloud teams.

Key responsibilities

• Lead technical deliverables for SIEM implementation and security operations engagements, including log source onboarding, parser development, SIEM content deployment through CI/CD pipelines using GitHub, detection use cases and operational readiness.
• Run PoC and PoV engagements to evaluate SIEM capabilities and demonstrate value to stakeholders.
• Conduct SIEM assessments to identify gaps and recommend improvements.
• Build and maintain data pipelines for log ingestion, normalization and enrichment across cloud and on-prem environments, integrating log sources with connectors, scripts and parsers.
• Develop use cases aligned with NIST and MITRE ATT&CK and implement detection rules using SPL/KQL with complex correlation.
• Build dashboards, alerts and workbooks, and implement SOAR workflows with Logic Apps, Phantom, Demisto and XSOAR.
• Tune and optimize SIEM platforms, and create and maintain documentation such as SOPs, runbooks, architecture diagrams and onboarding guides.
• Develop custom integrations for Microsoft Sentinel and Google SecOps, including scripts, APIs, parsers and data transformation logic, and apply AI responsibly to improve detection engineering and operations.

Required profile

• Bachelor's degree in computer science, cybersecurity or a related field.
• Minimum 3 years of experience in SIEM implementation and security operations.
• Experience in a consulting, client delivery or professional services environment is preferred.
• Ability to work collaboratively across teams and manage multiple client engagements.
• Preferred certifications: Microsoft Security Operations Analyst Associate (SC-200), AZ-500, Google Professional Cloud Security Engineer, CISSP, CISM, GIAC.

Required skills

• Hands-on experience with Microsoft Sentinel, Google SecOps, Palo Alto XSIAM, Devo and Splunk.
• Scripting in Python, PowerShell and Bash.
• Cloud platforms Azure, GCP and AWS.
• Data pipeline tools such as Cribl and DataBahn.
• SOAR platforms and playbook development.
• CI/CD practices with GitHub, REST APIs, JSON and Microsoft Office tools.

The salary range is $84,700 - $134,700, depending on skills, experience, qualifications and location. PwC Canada offers a hybrid work environment.