- Implementation of use cases using SPL/KQL with complex correlation across different data sources.
- Development of dashboards/workbooks, alerts.
- Implementation of SOAR workflows using Logic Apps, Phantom, Demisto etc. Minimum of 4-8 years of prior experience in SIEM Technologies, Information Security Expertise in SIEM solutions like Splunk, ArcSight and Azure Sentinel Tools. Expertise in building use cases around NIST and MITRE ATT&CK; framework to enable detection at various stages of a cyber attack.
Preferred Knowledge
- Basic knowledge of User Entity Behavior, Machine Learning models
- Scripting knowledge of python is an added advantage.
- Assist in administration, maintenance and optimization of the Splunk Enterprise and Splunk ES.
- Integrating log sources with Sentinel using REST API.
- Working knowledge of all architectural components of SIEM
- Knowledge about cloud environment and hybrid environments
- Experience of threat intelligence and threat hunting is added advantage. Implementation of clustered environment and related concepts such as High availability, parallel processing etc. Working knowledge in Azure services like Security center, azure monitor, log analytics, NSG, Storage, Azure Functions,defender ATP, etc.