Role Overview

Teceze is looking for an experienced HPE ArcSight Engineer to design, implement, configure, administer, monitor, and support enterprise Security Information and Event Management environments.

The successful candidate will have solid hands-on experience with HPE/OpenText ArcSight Enterprise Security Manager, ArcSight Logger, SmartConnectors, event correlation, log-source onboarding, content development, platform administration, and troubleshooting.

The ArcSight Engineer will work closely with SOC analysts, security architects, infrastructure teams, network teams, application owners, cloud teams, service-delivery managers, and customer stakeholders to ensure security events are collected, normalised, correlated, monitored, and retained effectively.

The role requires a combination of strong technical engineering skills, cybersecurity knowledge, analytical ability, documentation discipline, and customer-facing communication.

Key Responsibilities

ArcSight Platform Administration

- Install, configure, administer, maintain, and support HPE/OpenText ArcSight platforms.
- Manage ArcSight Enterprise Security Manager, ArcSight Logger, ArcSight SmartConnectors, Connector Appliances, Management Center, Consoles, and related components.
- Monitor the availability, health, performance, and capacity of ArcSight infrastructure.
- Perform routine platform health checks and resolve identified issues.
- Manage ArcSight services, system processes, storage, databases, certificates, user accounts, roles, and permissions.
- Configure authentication and role-based access controls.
- Manage ArcSight platform backups, restoration procedures, and disaster-recovery processes.
- Support high-availability, failover, and resilient ArcSight environments.
- Perform system upgrades, patches, hotfixes, migrations, and content updates.
- Review platform logs and diagnose service, database, connector, network, storage, and performance issues.
- Ensure ArcSight components are configured in accordance with security and operational standards.

Log-Source Onboarding

- Work with security, network, infrastructure, cloud, application, and business teams to identify and onboard security-relevant log sources.
- Configure log collection from Windows, Linux, network devices, firewalls, endpoints, applications, databases, cloud services, identity platforms, and security products.
- Deploy and configure ArcSight SmartConnectors.
- Configure Syslog, file-based, database, API, agent-based, and cloud-based event collection.
- Test connectivity between source systems, connectors, Loggers, and ESM components.
- Analyse raw logs and determine appropriate event-parsing requirements.
- Validate event fields, timestamps, severity, source and destination details, user information, device information, and other security attributes.
- Ensure logs are correctly normalised and categorised.
- Troubleshoot missing, delayed, duplicated, malformed, or incorrectly parsed events.
- Maintain log-source inventories, onboarding records, technical configurations, and ownership details.
- Perform post-onboarding validation to confirm event visibility and quality.

SmartConnector Management

- Install, configure, upgrade, and maintain ArcSight SmartConnectors.
- Configure connector destinations, filters, aggregation, batching, caching, and failover.
- Manage connector parsers, map files, properties, parameters, and supporting configuration files.
- Monitor connector status, event throughput, cache usage, system resource utilisation, and error logs.
- Troubleshoot connector crashes, parser failures,



connectivity issues, certificate errors, and destination failures.
- Configure load balancing and resilient connector architecture where required.
- Perform connector performance tuning based on events-per-second requirements.
- Maintain supported connector versions and apply vendor updates where appropriate.
- Ensure secure communication between SmartConnectors and ArcSight destinations.

FlexConnector Development

- Develop and maintain ArcSight FlexConnectors for unsupported or custom log sources.
- Analyse custom log formats and identify reliable event patterns.
- Create regular expressions and parser configuration files.
- Map source event fields to ArcSight event-schema fields.
- Configure timestamps, severity mappings, categories, device information, user information, network details, and custom fields.
- Test FlexConnector parsers using representative log samples.
- Troubleshoot parsing issues and improve parser accuracy.
- Document FlexConnector logic, assumptions, event mappings, and testing results.
- Maintain version control and change records for custom parsers.

Correlation and Use-Case Development

- Develop and maintain ArcSight correlation rules based on business, compliance, and threat-detection requirements.
- Create filters, active lists, session lists, dashboards, reports, queries, data monitors, trends, channels, and cases.
- Translate security threats and attack scenarios into ArcSight detection use cases.
- Develop rules for suspicious authentication activity, malware, ransomware, privilege misuse, data exfiltration, network attacks, insider threats, cloud threats, and policy violations.
- Align detection use cases with recognised threat frameworks where applicable.
- Define rule conditions, thresholds, time windows, event dependencies, exclusions, and actions.
- Configure rule actions such as notifications, case creation, active-list updates, scripts, and ticket creation.
- Test use cases using historical events, test events, and controlled scenarios.
- Tune rules to reduce false positives and improve detection accuracy.
- Review existing rules and retire outdated, duplicated, or ineffective content.
- Maintain use-case documentation, test evidence, tuning records, and release history.

ArcSight Logger Administration

- Configure and manage ArcSight Logger environments.
- Create and manage storage groups, retention policies, archive settings, and search permissions.
- Monitor storage utilisation, event ingestion, indexing, search performance, and retention.
- Configure event forwarding between ArcSight Logger, ESM, and other platforms.
- Develop Logger searches, reports, dashboards, and scheduled queries.
- Support security investigations requiring historical event searches.
- Manage event archives and restoration processes.
- Troubleshoot Logger ingestion, indexing, storage, forwarding, and search issues.
- Ensure retention policies meet customer, legal, contractual, and compliance requirements.

Monitoring and Troubleshooting

- Monitor ArcSight platform services and identify operational or security issues.
- Investigate event ingestion failures and gaps in security monitoring.
- Analyse ArcSight system logs, connector logs,



operating-system logs, and database logs.
- Resolve issues involving network connectivity, DNS, certificates, authentication, storage, system resources, event parsing, and service availability.
- Perform root-cause analysis for recurring or major incidents.
- Document findings, corrective actions, and preventive measures.
- Escalate vendor-related issues and work with HPE/OpenText support when required.
- Support priority incidents and major platform outages.
- Participate in on-call or out-of-hours support arrangements where required.
- Track incidents and service requests through the approved service-management platform.

Performance and Capacity Management

- Monitor ArcSight event volumes and events-per-second rates.
- Analyse platform CPU, memory, disk, database, cache, queue, and network utilisation.
- Identify capacity constraints and performance bottlenecks.
- Tune connectors, Managers, Loggers, databases, rules, dashboards, queries, and reports.
- Review data-retention and storage requirements.
- Provide capacity forecasts based on current utilisation, planned log sources, and customer growth.
- Recommend infrastructure, storage, licence, and configuration changes.
- Support performance and load testing for new integrations or significant changes.

Security Operations Support

- Support SOC analysts with event searches, investigations, dashboards, reports, and alert analysis.
- Assist analysts in understanding normalised ArcSight event fields.
- Support security incident investigations by extracting and correlating relevant events.
- Create investigation channels and queries for specific threat scenarios.
- Support threat-hunting activities using ArcSight data.
- Identify monitoring gaps and recommend new log sources or detection use cases.
- Assist with evidence collection for security incidents, audits, and compliance investigations.
- Ensure security alerts contain sufficient contextual information for effective investigation.
- Work with SOC teams to improve alert quality and analyst efficiency.

Integration with Third-Party Platforms

- Integrate ArcSight with firewalls, intrusion-detection and prevention systems, endpoint-security platforms, identity platforms, vulnerability scanners, email-security systems, cloud platforms, and business applications.
- Integrate ArcSight with Active Directory and Microsoft Entra ID.
- Support integrations with AWS, Microsoft Azure, Google Cloud, and software-as-a-service platforms.
- Integrate ArcSight with ticketing and IT service-management systems.
- Configure alert forwarding to email, scripts, APIs, SOAR platforms, and other SIEM tools.
- Support integrations using Syslog, REST APIs, JDBC, SNMP, CEF, JSON, XML, database queries, and file-based methods.
- Troubleshoot API, authentication, certificate, connectivity, and event-format issues.
- Document integration architecture, dependencies, ports, protocols, credentials, and support procedures.

Change and Release Management

- Follow formal change-management processes for ArcSight configuration changes.
- Prepare implementation plans, rollback plans, risk assessments, test plans, and change records.
- Test changes in non-production environments where available.
- Participate in technical and change-approval reviews.
- Implement approved changes within agreed maintenance windows.
- Validate platform health and event flow after each change.
- Maintain configuration baselines and change histories.
- Support release planning for platform upgrades, new log sources, parser changes, and detection content.

📌 HPE ArcSight Engineer (Bengaluru)
🏢 Teceze Consultancy Services
📍 Bengaluru