SIEM Administrator

Position Description:

Provides overall engineering support for the Splunk platform. Team is responsible for ingesting all required logs (on-prem and multi-cloud) to be used by the Security Operations Team for investigations and monitoring. Guide and mentor team members. Serves as a level 2 escalation point for the L1 team.

Position Summary:

• Work with IT Teams to remediate server vulnerabilities related to SIEM tool.
• Ingest required security logs per Voya policy.
• Develop and maintain weekly and monthly metrics reporting around security tooling coverage.
• Create and maintain cloud tenant and subscription logging alerts to proactively identify log outages and/or missing logs.
• Level 2 triage and troubleshooting of incident tickets related to ingestion outages
• Perform weekend validations and change work during established maintenance windows.
• Maintain currency by planning and organizing upgrades to maintain N-1 version.
• Create and maintain Runbooks for related processes.
• Participate in DR exercises.
• Gather and submit evidence for audit requests.
• Good knowledge on CRIBL.

Knowledge & Experience:

• 4+ years experience in related IT Security field, 2+ years Splunk experience
• Change management experience
• Strong analytical and problem-solving skills
• Experience deploying and supporting tools in a large environment (on-prem and multi-cloud).
• Strong written, verbal communication skills and interpersonal skills across with the ability to communicate with non-technical end users as well as technical IT teams.

Technical Expertise:

• Linux experience
• Python experience
• Powershell experience
• Splunk certifications
• CRIBL certification