Join our team at AMGEN Capability Center Portugal, the #1 company in Best Workplaces™ (201–500 employees' category) in Portugal in 2024 by the Great Place to Work Institute. With over 500 talented individuals from more than 40 nationalities, our Lisbon center thrives at the intersection of innovation, excellence, and inspiration. This is your opportunity to explore the future of healthcare through technology and digital innovation, supporting our mission To Serve Patients.
JUNIOR SIEM ENGINEER
At AMGEN, Technology isn’t just a support function—it’s a catalyst for discovery, transformation, and real-world impact. Here, your ideas fuel innovation that improves and saves lives of patients in dire need of our medicines. Are you ready to do meaningful work that matters?
LIVE
WHAT YOU WILL DO
As a Junior SIEM Engineer, you will play a key role in supporting the organization’s security monitoring strategy to help protect data, systems, and networks against threats. You will contribute to the design and day-to-day operation of monitoring capabilities, supporting early incident detection and ongoing platform maintenance. You will work closely with IT and Cybersecurity teams to embed security monitoring across multiple layers of the technology stack, with guidance from more senior engineers and a strong focus on best practices, risk management, and compliance with relevant standards.
Let’s do this. Let’s change the world. In this vital role you will:
- Support the implementation and maintenance of SIEM and UEBA platforms, especially activities related to log collection, connectors, and associated infrastructure components.
- Perform routine operational tasks such as monitoring SIEM health, validating ingestion pipelines, identifying common issues, and documenting findings and resolutions, with team guidance.
- Contribute to continuous improvement of SIEM/UEBA processes by updating procedures, maintaining technical documentation, making basic configuration adjustments, and suggesting enhancements based on daily observations.
- Develop simple scripts and basic automation routines (e.g., Python or PowerShell) to support log ingestion, normalization, and validation, working alongside senior staff.
- Collaborate with internal teams and escalate as needed to senior engineers or external partners to support resolution of platform issues, integrations, or security findings.
- Support incident response teams by providing relevant SIEM data and assisting with initial investigations (searches, log pivoting, basic context gathering) under team direction.
- Work with Security Operations (SOC) and Threat Intelligence teams on daily tasks such as alert validation, false positive review, basic correlation rule tuning, and initial troubleshooting.
- Help track vendor support cases by gathering evidence, recording activities, and maintaining documentation related to tools and strategic partners.
- Participate in internal and external audits by providing documentation and evidence related to SIEM controls and processes, following team guidelines
WIN
WHAT WE EXPECT OF YOU
We are all different, yet we all use our unique contributions to serve patients. The ideal candidate possesses strong leadership qualities, a deep understanding of cybersecurity practices, and extensive experience in managing large-scale security monitoring programs.
Basic Qualifications:
- Master’s degree with 0 to 1 years of experience in Information Systems or related field OR
- Bachelor’s degree with 1 to 2 years of experience Information Systems or related field OR
- Diploma with 2 to 3 years of experience in Information Systems or related field
- Foundational understanding of common security monitoring concepts (e.g., log collection, normalization, alerting, basic detection logic) through coursework, labs, internships, or entry-level experience.
- Working knowledge of cybersecurity frameworks and best practices (e.g., NIST, ISO 27001, MITRE ATT&CK) at a beginner-to-intermediate level.
- Basic exposure to incident response and risk concepts (e.g., triage, evidence collection basics, vulnerability awareness), with willingness to learn and follow established processes.
- Understanding of core security architecture principles (e.g., least privilege, defense-in-depth, segmentation) and ability to apply them with guidance.
Preferred Qualifications:
- Familiarity with log collection agents and pipelines (e.g., Splunk Universal Forwarder, Fluentd, Cribl) and exposure to SIEM platforms (e.g., QRadar, Splunk, ArcSight, Microsoft Sentinel) through internships, labs, coursework, or entry-level experience.
- Basic understanding of network security and endpoint security concepts (e.g., firewalls, DNS, proxy logs, EDR basics) and introductory exposure to incident response activities (triage support, evidence gathering basics, following playbooks).
- Basic scripting skills and willingness to automate repetitive tasks; Python and/or Bash/PowerShell are a plus (personal projects, labs, or academic work acceptable).
- Introductory experience with cloud fundamentals (AWS/Azure/GCP) and awareness of cloud-hosted monitoring/logging components; hands-on exposure via labs, certifications, or internships is a plus.
Professional Certifications:
- GCDA (preffered)
- GSEC (preferred)
- CompTIA Security+ (preferred)
Soft Skills:
- Excellent analytical and solving skills
- Strong verbal and written communication skills (English)
- Ability to work effectively with global, virtual teams
- High degree of initiative and self-motivation
- Ability to handle multiple priorities successfully
- Team oriented, with a focus on achieving team goals
- Strong presentation and public speaking skills
