About the Role
We are seeking a skilled SIEM Administrator to manage and optimize different SIEM solutions. The ideal candidate will be responsible for system administration, log integration, troubleshooting, Deployment, Implementation and maintaining security posture for the organization.
Key Responsibilities
SIEM Administration:
- Install, configure, maintain, and upgrade SIEM components. (IBM Qradar SIEM, DNIF, Splunk & Securonix).
Log Management:
- Onboard, parse, and normalize logs from various data sources (firewalls, servers, databases, applications, etc.)
- Custom log source integration and parser development.
System Monitoring & Troubleshooting:
- Ensure SIEM tools are functioning optimally. Monitor & regular health check perform for SIEM tools. troubleshoot system errors and resolve performance issues.
- Conduct regular performance tuning and capacity planning
- Perform root cause analysis for system failures & performance issues.
- Optimize system performance and storage management for SIEM
Integration & Automation:
- Integrate third-party security tools (firewalls, EDR, threat intelligence feeds) with SIEM.
Compliance & Audits:
- Ensure log retention policies comply with regulatory standards.
- Develop & enforce SIEM access controls & user roles/permissions.
Documentation & Training:
- Document system configurations, SOP's & troubleshooting documents.
- Prepare monthly/ weekly reports and PPT, onboarding documentation as per business/ client requirement.
Dashboard & Report Development:
- Create & maintain custom dashboards & reports
- Optimize searches & reports for performance and efficiency.
- Hands on experience with Linux OS & Windows OS
- Basic to mediator level knowledge in networking skills
- Should be familiar with Azure, AWS or GCP products
Basic Qualifications
- B.E./B.Tech in Computers or related field (preferred).
- 4+ Years of Experience in SOC Administration.
- Strong knowledge of SIEM architecture, log sources, and event correlation.
Preferred Qualifications
- Proficiency in log management, regular expressions, and network security concepts.
- Experience integrating SIEM with various security tools (firewalls, IDS/IPS, antivirus, etc.)
- Scripting knowledge (Python, Bash, or PowerShell) is a plus.
- Training or Certificate on Splunk or IBM Qradar Preferred.
- Experience with SIEM tools like IBM QRadar, Splunk, Securonix, LogRhythm, Microsoft Sentinel, DNIF etc.
- Proficiency in IBM Qradar & Splunk administration.
- Configuring, maintaining, and troubleshooting SIEM solutions.
- Strong analytical and problem-solving skills.
- Excellent communication and documentation abilities.
