SIEM Engineer

Job highlights

• Knowledge of the Common Information Model,data models,enrichment,and automation . Good experience on Splunk add-Ons installation / configuration to bring security logs into Splunk

• . Good understanding of the Security Domain

• Building, maintaining, and operating Splunk Enterprise and Splunk Enterprise Security SaaS Solution

• Building Co-relation searches for Cyber Operation requirements

• Evaluating and analysing business requirements and designing suitable solutions, challenging requirements where necessary

• Managing, co-ordinating and implementing technical project activities and enhancements to services

• Conducting Incident/ Problem/ Recovery activities

• Supporting the Joint Operations Centre and incident response teams for detected security events

• Creating and maintaining accurate and high-quality documentation
  Supporting Operational effectiveness audit

• Structure phased deliverables to link long term vision with time-boxed activities

• Support the project delivery phase including testing and training, to ensure the agreed business solutions are delivered successfully

• Work closely with developers and testers, to ensure delivery of the functionality on time and with quality

• Stakeholder Management and Leadership

• Negotiate and solicit engagement and support at all levels of the organisation, particularly where support is low or challenging

• Communicate clearly and regularly

• Typically faces off to AVP / VP level stakeholders

• Considers the impact of their actions and decisions on key stakeholders, seeking to deliver a positive outcome for those involved

• Decision-making and Problem Solving

• Apply evaluative judgement and analytical skills to operate effectively within a complex and changing environment

• Understand the requirements and perspectives of stakeholders and integrate into their understanding of complex situations

• Demonstrates a broad understanding of how the bank operates and the metrics used to measure performance

• Analyses problems and evaluates options in a logical and systematic way

• Seeks the advice of stakeholders to better create clarity in complex situations, understand problems, evaluate options and make decisions

What we are looking for:

• Knowledge of Splunk Enterprise architecture, distributed components (indexer clusters, forwarders, search head clusters, deployment servers) , knowledge of Splunk Cloud
• Knowledge of Splunk Enterprise Security at administration and use case level
• Knowledge on on-boarding new data into Splunk, Splunk Forwarders - data ingestion, extraction.
• Knowledge of the Common Information Model, data models, enrichment, and automation
• Good experience on Splunk add-Ons installation / configuration to bring security logs into Splunk.
• Good understanding of the Security Domain.
• Documentation skills in order to provide high quality documentation for internal customers and technical teams