Analyst - SIEM & Data Engineer (Splunk Admin)

About the Role

SIEM & Data Engineer

Corporate Title: Analyst

Reporting to: VP

Location: Bengaluru

Exp: 5 to 8 yrs

Work Location: Bangalore Hybrid model (2-3 days WFO weekly basis)

Shifts: 12:00 PM to 9:00 PM IST/1:00 PM to 10:00 PM IST depending on day light savings.

Roles and Responsibilities

• Must be a technical expert on SIEM products and technology
• Research and look for opportunities to adopt the best practices and industry standards to enhance the SIEM platforms
• Engineer and implement various solutions on SIEM platforms as per business requirements
• Define SIEM platform standards including data schema, modelling, normalization, monitoring and alerting
• Must have experience in dashboard and reporting as per requirements
• Should have experience in AI and ML to build the modern SIEM and data monitoring solution.
• Must be able to configure SIEM products with different policies, rules and configurations.
• Must be able to customize the SIEM products if out of the box solution is not available
• Define standard patterns to integrate different systems into SIEM platforms
• Generate different types of reports using SIEM data
• Identify opportunities to enhance the current baseline processes and configuration
• Produce engineering, integration and process related documentation.
• Manage vendor relationships to drive roadmap, solution design, implementation and troubleshooting
• Work with key stakeholders of the services to ensure the expectations are meeting the requirements
• Able to conduct the POC of new features to develop new solutions
• Knowledge of various applications and systems that include Servers, middleware, Clouds (SaaS, PaaS and IaaS), Containers, to come up with the right approach of SIEM integration
• Lead pro-active System Security Specific reviews and self-assessments of the policies, procedures and systems, including but not limited to distributed computer systems, Internet, Intranet, and Extranet networks.
• Ability to understand security risks and controls, to analyze various methods of controlling information security problems, determine the strengths and weaknesses of each method and implement the best cost-justified solution
• Ability to provide technical directions to other peer staff members, and to train new staff on the security team

Job Requirements:

At least 5+ years of experience in technology with emphasis on cyber security.

• At least 3+ years of experience in SIEM products such as Splunk, Cribl, Elastic, Datadog, AWS CloudTrail, cloud watch, Azure event hub, AWS S3, etc.
• At least 1+ years of experience in Data Lake and data warehouse using products such as AWS S3, Snowflake, Databricks, etc.
• Experience with scripting is highly preferred like Python, Ansible etc.
• Experience in creating trending, metrics, and management reports
• Experience working in complex and large-scale environments.
• Familiar with industry security regulations and frameworks (MITRE Attack Framework, CIS, etc.)
• Experience in creating trending, metrics, and management reports
• Knowledge of Common Information Model mapping is required
• Working knowledge in RegEx, Splunk search language, etc. is required.
• Experience working in the financial services (Top 10 banks preferred) with knowledge of regulations such as FFIEC, SOX, or other highly regulated industries such as healthcare, utilities, or aerospace.
• Knowledge and experience operating in hybrid-cloud environment.
• Knowledge and experience with SIEM management solutions.
• Knowledge of networking fundamentals (e.g. TCP/IP) and strong troubleshooting skills.
• Knowledge of modern security principles and their practical applications.
• Knowledge and experience in AWS or Azure

Education:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field, or relevant industry certifications. Equivalent work experience is equally preferable.

Preferred Certifications: Are these really preferred? Its ok if they just wanted to ask if we are on track with the correct Certs

• Certified Information Systems Security Professional (CISSP)
• Certified Information Systems Manager (CISM)
• Certified Information System Auditor (CISA)
• Certified Ethical Hacker (CEH)

Please mention your years of experience on the below skills, while submitting your profile.

Log Data Onboarding

Upgarding Splunk Core & ES application

Experience building SOC use Case

Data Normalization

CIM Model Mapping

use case enablement

SOAR Exp

Splunk Cloud exp

Version Control exp

Experience onboarding data and extraction abilities