Crowdstrike NG SIEM and Onum Engineer

Do you love a career where you Experience, Grow &
Contribute at the same time, while earning at least 10% above the
market? If so, we are excited to have bumped onto you.

Learn how we are redefining the meaning of work ,
and be a part of the team raved by Clients, Job-seekers and Employees.

• Jobseeker Video Testimonials
  
• Employee Glassdoor Reviews
  

If you are a Crowdstrike NG SIEM and Onum Engineer looking
for excitement, challenge and stability in your work, then you would be glad to
come across this page.

We are an IT Solutions Integrator/Consulting Firm helping
our clients hire the right professional for an exciting long-term project. Here
are a few details.

Check if you are up for maximizing your earning/growth
potential, leveraging our Disruptive Talent Solution.

Requirements

Work you’ll do

You will administer and support the CrowdStrike Falcon Next-Gen SIEM & Falcon Onum platform, including architecture changes, log source onboarding, data pipeline management with Falcon Onum, use-case development and platform health. You will work closely with SOC, threat intelligence, infrastructure and security teams and serve as an advanced escalation point for potential security incidents. Your job responsibilities include:

• Provide architecture analysis, design and support for the platform, including Falcon Onum data pipeline architecture
  
• Onboard log sources (servers, endpoints, Active Directory, firewalls, VPN, cloud and SaaS platforms, applications and databases) using collectors, syslog, API-based connectors, and custom scripts methods into NGSIEM and Onum.
  
• Gather onboarding requirements from clients and coordinate with their infrastructure and application teams to complete integrations
  
• Develop, test and maintain parsers and field normalization for custom and third-party log sources in CrowdStrike NGSIEM
  
• Design, build and maintain Falcon Onum pipelines to ingest, parse, filter, enrich, transform and route telemetry from third-party sources into Falcon Next-Gen SIEM and other destinations
  
• Write, tune and manage detection rules, correlation searches and alerts using CrowdStrike Query Language (CQL)
  
• Drive detection coverage and gap analysis using frameworks such as MITRE ATT&CK
  
• Build and maintain dashboards, reports and metrics, including log source, pipeline health and ingestion monitoring
  
• Optimize data ingestion, filtering and retention to manage licensing and storage costs, using Falcon Onum to reduce low-value data and route it to the right destinations
  
• Develop automation and response workflows (for example, Falcon Fusion) and integrate with ticketing and threat intelligence tools
  
• Troubleshoot complex issues across the SIEM platform, Falcon Onum pipelines, log collectors, servers, endpoints and networks
  
• Create and maintain standard operating procedures (SOPs) and onboarding documentation, and submit them through the Quality Review Management process
  
• Mentor and train junior engineers
  
• Build relationships with client counterparts and represent the team in client meetings
  
• Adhere to internal operational security and other Deloitte policies
  

Qualifications Required:

• Candidate should have overall 4+ years’ experience in SIEM engineering, administration or security monitoring
  
• Hands-on experience with CrowdStrike Falcon Next-Gen SIEM / LogScale and Falcon Onum.
  
• Experience onboarding and troubleshooting log sources using agents, syslog, API-based connectors and Falcon Onum pipelines in CrowdStrike Falcon Next-Gen SIEM
  
• Proficient understanding of common log sources, including Windows Event Logs, Linux syslog, Active Directory, firewall and VPN logs, web server logs, database audit logs and cloud audit logs
  
• Experience writing detection logic and search queries in CQL, including regular expressions for parsing
  
• Experience with data pipeline concepts such as filtering, parsing, enrichment, routing and data reduction, ideally using Falcon Onum or comparable tools (for example, Cribl)
  
• Proficient understanding of IT infrastructure, security technologies and other security tools
  
• Knowledge of Advanced Persistent Threat (APT) tactics, techniques and procedures, and experience mapping detections to MITRE ATT&CK
  
• Understanding of common attack activities such as scanning, malicious code, credential attacks and lateral movement
  
• Understanding of basic networking protocols such as TCP/IP, DNS, HTTP and TLS
  

Preferred:

• Certifications in CrowdStrike SIEM and other SIEM tools
  
• Hands-on experience in onboarding logs to Falcon Onum, designing and operating Falcon Onum pipelines, and multi-destination routing
  
• Excellent interpersonal and organizational skills
  
• Excellent oral and written communication skills
  
• Strong analytical and problem-solving skills
  
• Self-motivated to improve knowledge and skills
  
• A strong desire to understand what as well as the why and the how of security incidents
  

Benefits