About the job
SKELAR is a venture builder that creates international product IT companies based on the principles of the venture capital world. Together with our co-founders, we assemble strong teams to launch tech businesses and succeed in global markets.
Currently, SKELAR has a number of businesses across various niches, from EdTech to marketplaces. These companies rank among the top startups and product companies in Ukraine, achieving high positions in the App Store and developing platforms used by millions. Our businesses have been covered by global media such as TechCrunch and Wired.
We are establishing our own Security Operations Center (SOC) within SKELAR, and we are in need of an architect who can transform raw logs into a transparent security system. Your mission will be to build an internal Security Information and Event Management (SIEM) system, establish monitoring processes, and ensure we are aware of threats before they escalate. This is a unique opportunity to create processes from scratch (Greenfield) for an infrastructure with over 2000 users and more than 1000 devices.
Challenges Awaiting You:
— SIEM Building & POC: You will independently analyze the market, propose solutions for SIEM, conduct Proof of Concept, and implement a comprehensive monitoring system for our infrastructure;
— Visibility & Log Engineering: Configure the collection, parsing, and correlation of logs from over 1000 devices (macOS/iOS), cloud environments (GWS, AWS/GCP), and other corporate systems;
— Incident Management Framework: Develop the alert processing and incident management process. Create detailed Playbooks that the team will follow in the event of a confirmed threat;
— Detection Engineering: Develop custom detection rules for anomalies, indicators of compromise (IoC), and attacks specific to SKELAR's business logic.
What Matters to Us:
SIEM & Log Management:
— Deep experience in building, deploying, or administering SIEM systems (e.g., ELK Stack, Wazuh, Splunk, Panther, Datadog Cloud SIEM);
— Understanding of log architecture and data lifecycle: ability to configure Log Shippers (Filebeat, Fluentd, etc.), work with Webhooks, normalize and filter data (JSON, Syslog).
Detection & Response:
— Practical experience in Detection Engineering: writing custom alerting rules (YARA, Sigma, or specific query languages like KQL/SPL);
— Experience in developing and implementing Incident Management & Response processes (from triage to post-mortem).
Methodologies & Best Practices:
