Splunk Engineer

Job Description

SIEM Infrastructure administration:

- Perform SIEM health check

- Monitor SIEM Server Storage, CPU and Memory Usage and perform necessary action.

- Perform SIEM version upgrade

- Update splunk configurations based on security advisory

- SIEM Infra Tuning and Performance Optimization

- Monitor SIEM data sources proactively to identify issues in the environment (ex: Index Cluster / Search head cluster issues / etc)

SIEM Data onboarding

- Data Onboarding (Including first level assessment, UAT Testing before live)

- Integration numerous logs sources including servers (Windows & Linux), devices and security tools like NAC, PAM, NBAD, IPS DAM, DLP, AV etc.

- Data Parser and CIM Mapping Configuration

SIEM Use Case Development:

- Finetuning existing use cases

- Build new use cases

SIEM Troubleshooting and Splunk servers reconciliation:

- Troubleshoot, investigate and remediate identified SIEM issues

- Monitor and troubleshoot the servers that have stopped reporting

- Troubleshooting issues with search scheduler management

- Search head tuning and optimization, for missed searches, failed jobs and scheduling searches etc.

- Liaise with IT support groups & service providers to resolve outstanding issues such log onboarding (e.g. HF related issue – Core team, source related issue – Cyber team to coordinate)

- Reconcile Splunk servers periodically

SIEM Documentation:

- Prepare/update SIEM tool SOPs

- Update Splunk built documents, whenever there are changes to Splunk deployment architecture

- Prepare/update Splunk guide for agent installations

EA Number: 11C4879