Lead, Info Security Systems

Job ID:  16337  Alternate Locations:      Newell Brands is a leading consumer products company with a portfolio of iconic brands like Graco®, Coleman®, Oster®, Rubbermaid®, Sharpie® and Yankee Candle® - and 24,000 talented teammates around the world. Our culture is built on values in action: Integrity, Teamwork, Passion for Winning, Ownership, and Leadership. We work together to win, grow, and make a real impact—supported by a high-performing, inclusive, and collaborative environment where you can be your best, every day.     Position Title: Senior CyberSecurity Specialist - Engineer (SIEM/SOAR) Location: Remote Reports To: Senior Manager, Security Engineering     Company Overview     Newell Brands (NASDAQ: NWL) is a leading global consumer goods company with a strong portfolio of well-known brands, including Rubbermaid®, Paper Mate®, Sharpie®, Dymo®, EXPO®, Parker®, Elmer’s®, Coleman®, Marmot®, Oster®, Sunbeam®, FoodSaver®, Mr. Coffee®, Rubbermaid Commercial Products®, Graco®, Baby Jogger®, NUK®, Calphalon®, Contigo®, Mapa®, Spontex® and Yankee Candle®.  Newell Brands is committed to enhancing the lives of consumers around the world with planet friendly, innovative, and attractive products that create moments of joy and provide peace of mind.     Job Summary     The Senior Cybersecurity Specialist - Engineer (SIEM/SOAR) is a hands-on engineering role responsible for the design, build, and continuous optimization of Newell Brands’ SIEM and SOAR capabilities. This role owns the full lifecycle of detection engineering – from ingestion and correlation through automated response – and serves as the technical authority for SOAR playbook development and AI-driven workflow automation across the Security Operations function. This is a conversion of a current contractor engagement into a full-time position, enabling expanded scope, deeper cross-team integration, and long-term program ownership.     Key Responsibilities

Own SIEM architecture, content development, and ongoing tuning including log source onboarding, parsing, normalization, and field mapping Serve as the primary engagement lead for internal SIEM customer teams, owning recurring touchpoints with data owners and data consumers and ensuring consistent service experience Manage the intake and lifecycle of customer requests from initial capture through structured triage to fulfillment Serve as the primary administrator, technical lead, and subject matter expert for Cribl Stream hybrid deployment, owning all sources, destinations, routes and processing pipelines across cloud and on-premises worker groups Lead Cribl Edge expansion by engaging data owners on agent deployment and validating collection health for newly onboarded sources Support administering multi-tenant CrowdStrike NG-SIEM environment, managing child tenant log source retention and RBAC for content and data repositories Build and maintain alerting, monitoring, and forecasting of data health and license usage for data ingestion and SIEM platforms Develop and maintain high-fidelity detection rules, correlation logic, and threat-based use cases aligned to MITRE ATT&CK in support of data consumers Continuously measure and report detection coverage gaps and use-case performance (false positive rate) Own the full Falcon Fusion SOAR environment: design, build, test, and maintain automated response playbooks across the incident lifecycle Develop AI-assisted triage workflows that classify alerts, enrich cases with threat intel, and route to the correct analyst or automated response path Integrate SOAR with security tooling across the stack: CrowdStrike, Palo Alto, Microsoft Defender, Tenable, Wiz, and external threat intelligence feeds Document all playbooks with runbooks, decision logic, and exception handling so continuity does not depend on a single engineer Define and maintain SOAR SLAs and