Resident Engineer L3 SIEM Admin

JOB PURPOSE

To lead the administration, configuration, optimization, and advanced operations of the organization’s SIEM platforms, primarily supporting Splunk SIEM, while also supporting environments utilizing other SIEM technologies such as QRadar and ArcSight, ensuring effective log ingestion, attack detection, threat analysis, incident investigation support, and continuous improvement of SOC monitoring capabilities, including coordination across teams and support for SIEM platform transition or migration activities when required

 KEY RESPONSIBILITIES

Key Responsibilities

• Administer, configure, maintain, and optimize enterprise SIEM platforms in production environments.


• Perform SIEM architecture tuning, performance optimization, and capacity management.


• Configure and maintain correlation rules, alerts, dashboards, and detection policies to support advanced threat detection.


• Lead onboarding, parsing, normalization, and ingestion of logs from infrastructure, applications, endpoints, network, and cloud services.


• Perform advanced log and attack analysis to support threat detection and SOC investigations.


• Act as escalation point for complex incidents requiring deep log and platform analysis.


• Support incident response activities by providing log intelligence and assisting investigation and forensic activities when required.


• Troubleshoot SIEM platform issues and support operational problem resolution.


• Coordinate investigations and operational activities across SOC, Incident Response, Vulnerability Management, Infrastructure, and application teams.


• Develop automation scripts and integrations using scripting languages to improve SOC operational efficiency.


• Support SIEM platform transition or migration initiatives including data source onboarding, validation, and detection use case alignment.


• Ensure SIEM platform availability, scalability, and storage efficiency.


• Maintain technical documentation, operational procedures, and configuration standards.


• Support audit, compliance, and regulatory monitoring requirements through log analysis and reporting