L3 SIEM - Roles Responsibilities
Experience (8-12 Years)
1.Advanced Incident Support Root Cause Analysis
Support L2 in handling complex and critical security incidents Perform deep forensic analysis and root cause identification Investigate sophisticated threats (APT, zero-day behavior, stealth attacks) Provide final technical validation and resolution guidance 2.SIEM Agent Management
Manage upgrades, patches, and hotfix deployments for System monitor agents Ensure Log Source MPS volume analysis 3.Log Source Integration Parsing
Design and onboard new log sources across on-prem and cloud environments Develop and maintain parsing logic, normalization, and field mappings Resolve complex ingestion issues (protocol, TLS, format mismatches) Ensure data quality and consistency across all sources 4.Detection Use Case Development
Design and implement advanced correlation rules and detection logicBuild new use cases aligned with frameworks like MITRE ATTCKIntegrate threat intelligence feeds and automation into detection workflowsContinuously enhance detection coverage and reduce blind spots5.Automation SOAR Integration
Add/Maintain automation workflows and response playbooks Integrate SIEM with SOAR and other security tools (EDR, IAM, Firewall) Optimize response time through orchestration and automation 6.Performance Optimization Troubleshooting
Diagnosing and resolving log source- issues Optimize pipelines, indexing, and query performance 7.Governance, Compliance Best Practices
Define SIEM standards, architecture guidelines, and best practices Ensure compliance with regulatory and audit requirements and support customers on Audits Maintain documentation for configurations, integrations, and fixes 8.Collaboration Technical Leadership
Act as the escalation point for L2 and guide them on complex investigations Provide technical leadership, mentoring, and knowledge sharing Collaborate with infrastructure, cloud, and application teams 9.Continuous Improvement Innovation
Identify gaps in detection, logging, and response capabilities of log sourcesDriving use case enhancements and modernization initiativesEvaluate and implement new security technologies and integrations and validate overall security maturity assessment.10.Reports
Based on customers, Drive Daily/ Weekly/ Monthly/ Quarterly reportsProvide visibility and drive calls with customers.
