Role Summary
Experienced ArcSight Engineer to design, implement, configure, administer, and support enterprise SIEM environments using HPE/OpenText ArcSight (ESM, Logger, SmartConnectors). Will work cross-functionally with SOC, security architecture, infrastructure, network, cloud, and customer stakeholders to ensure security events are collected, correlated, monitored, and retained effectively.
Key Responsibilities
- Platform Administration: Install/configure/maintain ArcSight ESM, Logger, SmartConnectors, Connector Appliances, Management Center; manage HA/DR, backups, upgrades, patches, RBAC.
- Log-Source Onboarding: Onboard Windows, Linux, network, cloud, application, and security log sources; validate event parsing, normalization, and field accuracy.
- SmartConnector Management: Deploy, tune, and troubleshoot connectors (filters, load balancing, caching, failover, EPS performance).
- FlexConnector Development: Build custom parsers/regex for unsupported log sources; map fields to ArcSight schema.
- Correlation & Use-Case Development: Write and tune correlation rules, dashboards, reports, active/session lists; map use cases to threat scenarios and reduce false positives.
- Logger Administration: Manage storage, retention, indexing, forwarding, and search performance.
- Monitoring & Troubleshooting: RCA for platform/connector/event issues; support major incidents and on-call rotations.
- Performance & Capacity Management: Monitor EPS/throughput, tune components, forecast capacity.
- SOC Support: Assist analysts with investigations, threat hunting, and alert quality improvement.
- Third-Party Integrations: Firewalls, IDS/IPS, EDR, IAM (AD/Entra ID), cloud (AWS/Azure/GCP), SOAR, ITSM tools via Syslog/REST/JDBC/CEF/SNMP.
- Change Management: Follow formal change process — implementation/rollback plans, testing, approvals, documentation.
