Principal Cyber Security Engineer

Work Location(s)500 Woodward Avenue, MI, 601 S. Tryon Street, NC

Work Schedule:

Ally designates roles as (1) fully on-site, (2) hybrid, or (3) fully remote. Hybrid roles are generally expected to be in the office a certain number of days per week as indicated by your manager. Your hiring manager will discuss this role's specific work requirements with you during the hiring process. All work requirements are subject to change at any time based on leader discretion and/or business need.

We are seeking a Principal Cyber Security Engineer with hands-on experience designing, deploying, and optimizing SIEM (Security Incident & Event Management) platforms  individual will own the end-to-end lifecycle of SIEM capability—from architecture and data onboarding to content engineering, automation, and continuous improvement. The individual will collaborate with SOC analysts, incident responders, threat hunters, IT operations, and application teams to ensure high-fidelity detections, actionable visibility, and reliable, compliant log management.
* At this time, Ally will not sponsor a new applicant for employment authorization for this position.
** Optimize SIEM performance: indexing, search speed, hot/warm/cold storage, retention, and cost control.
* Implement role-based access control, multitenancy (if applicable), and data governance.
* Ensure high availability and disaster recovery; document and test failover procedures.
* Define KPIs/KRIs (e.g., MTTD, alert quality, data freshness, coverage, false positive rate).
* Lead purple-team exercises and detection gap assessments; drive remediation.
* Provide runbooks, knowledge base articles, and training to SOC and IT teams.
* Align SIEM data handling with regulatory and contractual requirements (e.g., SOC 2, ISO 27001, PCI-DSS, HIPAA, GDPR).
* Implement data minimization, masking, and retention policies, support audits and eDiscovery.### The Skills You Bring
** Minimum Qualifications
*** 7+ years of relevant experience
* Bachelor's degree or equivalent
** Preferred Qualifications**
* * Highly preferred:
* 5+ years of experience in SIEM engineering or closely related security engineering roles.
* * Highly preferred:
* Proven expertise with at least one enterprise SIEM platform end-to-end, preferably Splunk and Cribl (e.g., Splunk, Microsoft Sentinel, QRadar, Elastic Security, Exabeam, Sumo Logic, Log Rhythm, Chronicle).
* Strong proficiency in:+ Data parsing and normalization (e.g., regex, grok, KQL, SPL, AQL, Lucene).+ Scripting/automation (e.g., Python, Power Shell, REST APIs, Terraform/Ansible preferred).+ Log source onboarding from Windows/Linux, AD, network devices, cloud services, EDR, and SaaS.
* Experience with cloud logging and security services (e.g., AWS Cloud Trail/Cloud Watch/Guard Duty, Azure Defender/M365, GCP Audit Logs).
* Experience with Agile methodologies and collaborative work environments.
* Familiarity with identity and access management, network security, endpoint security, and common enterprise architectures.
* Excellent communication and stakeholder management skills.
* Experience with UEBA/behavior analytics and anomaly detection.
* Experience with EDR/XDR integrations and telemetry correlation.

* Certifications:

GCDA, GCIA, GCFE, GCIH, GMON, Splunk Certified Architect, Microsoft Certified:
Cybersecurity Architect, AWS/Azure security certs, CISSP.#LI-Hybrid Incentive Compensation:
This position is eligible to participate in our annual incentive plan.

Ally's compensation program offers market-competitive base pay and pay-for-performance incentives (bonuses) based on achieving personal and company goals. Our Total Rewards program includes industry-leading compensation and benefits plus additional incentives that are designed to meet your needs and those of your family so you can get the most out of your career and your life, including:
* ** Time Away:
** Program starts at 20 paid time off days in addition to 11 paid holidays and 8 hours of volunteer time off yearly (time off days are prorated based on start date and program varies based on full or part-time status and management level).
* ** Planning for the Future:
** plan for the near and long term with an…