Vacant job

About the role

As a SIEM Expert, you are responsible for the operation, management, and development of Svenska kraftnät's SIEM solution for security monitoring. You contribute to strengthening security in one of Sweden's most critical infrastructure operations by developing and improving security monitoring in a complex IT and OT environment.

You operate and maintain the security monitoring platform Splunk and work closely with the platform's users within the Security Operations Center (SOC) as well as the IT operations organization. The role includes, among other things, configuration and management of Splunk clusters, Linux administration, and content development within the platform.

The role involves, among other things:

• Operate, manage, and develop Svenska kraftnät's SIEM solution for security monitoring.
• Develop new features in the SIEM solution.
• Develop and manage data models in the SIEM platform.
• Meet the needs of SOC analysts through close dialogue and tight collaboration.
• Perform operational and management tasks within the SIEM system.
• Work together with IT operations to connect new IT systems to the SIEM platform.
• Be part of Svenska kraftnät's team for handling IT security incidents.

Here, you have the opportunity to develop within IT security in an operation with high security requirements. The role offers great opportunities for personal development and continuous competence development. You will work together with experienced colleagues, share knowledge both internally and with external partners within the industry and the public sector, and contribute to the continued development of Svenska kraftnät's security monitoring.

You are located in the Operational IT Security unit, which is part of the IT Security Department. Here, you work in a team of approximately 20 technical IT security specialists who together are responsible for maintaining, developing, and improving Svenska kraftnät's security platform. You work with systems spanning both IT and OT environments in a critical infrastructure operation.

About you

Requirements:

Personal qualities:

We are looking for someone who is collaborative, analytical, structured, and solution-oriented. You thrive when collaborating with others and have a structured working method that helps you analyze complex technical environments and find sustainable solutions.

You must also adhere to the Swedish government's value base (https://www.statskontoret.se/forvaltningskultur/den-statliga-vardegrunden/).

In this recruitment, we place great emphasis on your personal qualities.

Education:

You have an academic education in IT or equivalent competence acquired in another way that Svenska kraftnät assesses as equivalent.

You also have:

• Good experience in implementation/operation of SIEM solutions (at least 1 year of work experience).
• Experience working with distributed solutions (e.g., cluster solutions, collectors, indexers, GUI).
• Knowledge of regular expressions and scripting in e.g., Python, Bash, PowerShell.
• Good experience working in Linux (RHEL/CentOS).
• Good experience managing systems using automation languages (e.g., Ansible).
• Good ability to express yourself in speech and writing in Swedish and English.

Meritorious qualifications

• Good experience with data onboarding of various systems/products and data normalization.
• Experience building advanced alerts, reports, and visualizations.
• Experience working within a SOC (Security Operations Center).
• Experience with Splunk and Splunk Enterprise Security.
• Relevant education and certifications on SIEM solutions.
• Experience with security work in ICS and SCADA systems.
• Experience with IT and information security work in larger organizations.

Good to know

• The position is located in Stockholm / Sundbyberg.
• Opportunity for remote work up to 50% (#LI-hybrid).
• The application deadline is September 9, 2026. We use screening questions instead of a cover letter. Please attach your CV in Swedish where you clearly describe the experience we are looking for.
• The position is a permanent position.
• Read more about our benefits: https://www.svk.se/jobba-har/var-arbetsplats/formaner/ (https://www.svk.se/jobba-har/var-arbetsplats/formaner/)

In this recruitment, we collaborate with Experis. Want to know more? Please contact recruitment consultant Carina Eyoma, tel. 073-086 22 75 or via email: [email protected].

Due to holiday periods, response times may be slightly longer than usual.

Contacts at Svenska kraftnät:

• Carl Isaksson, Recruitment Specialist, 010-489 20 28
• Annika Ingeborn, SACO, 010-475 87 72
• Erica Midfjäll, ST, 010-475 87 31

You can also reach us via email: [email protected]

https://www.svk.se/jobba-har/ (https://www.svk.se/jobba-har/)

We decline direct contact from staffing and recruitment agencies as well as salespeople in connection with recruitment; we have procured agreements that apply to Svenska kraftnät as a government agency.

Other information

We have high demands on our employees' security and confidentiality awareness. Prior to employment, a security clearance is conducted in accordance with the Security Protection Act (2018:585), which includes a basic investigation and, if the position involves a security-classified role, also a register check. For employment at Svenska kraftnät, Swedish citizenship may be required for certain positions. The employment includes an obligation to be placed in wartime duties. For more information about personnel security at Svenska kraftnät, see: https://www.svk.se/sakerhet-och-beredskap/sakerhetsskydd/personalsakerhet (https://www.svk.se/sakerhet-och-beredskap/sakerhetsskydd/personalsakerhet)