SOC - SIEM Admin Specialist

Job Description: Security Operations Centre – SIEM Admin Specialist

Reporting Structure

Reports to Lead – Security Operations Centre

Location – Mumbai

Education

·Bachelor's degree in Cybersecurity, Information Technology, or a related field (preferred).

Experience/ Qualifications

·Minimum of 4 to 6 years of experience in a SIEM administrator role.

·Proven experience with a leading SIEM platform (e.g., Splunk, QRadar, ArcSight).

·Strong understanding of log management principles and practices.

·Working knowledge of network security concepts and protocols.

·Proficiency in scripting languages (e.g., Python, PowerShell) would be added advantage.

·Excellent analytical and problem-solving skills.

·Strong communication and collaboration skills.

·Ability to work effectively in a fast-paced, dynamic environment.

Industry

·Financial Domain (Banking / NBFC experience is desirable)

Responsibilities

SIEM Management:

• Install, configure, and maintain the SIEM platform according to best practices.
• Manage user access and permissions for the SIEM.
• Perform regular backups and disaster recovery testing.
• Monitor system performance and health, troubleshooting and resolving issues.
• Stay up-to-date on emerging threats and vulnerabilities, updating SIEM rules and detections accordingly.

Log Management:

• Configure log sources and ensure seamless log collection from various network devices, applications, and systems.
• Normalize and enrich log data for effective analysis and correlation.
• Design and implement custom log parsing rules for specific applications or devices.
• Monitor log volume and disk space usage, optimizing storage as needed.

Security Monitoring and Analysis:

• Proactively monitor SIEM alerts and dashboards for potential security incidents.
• Investigate triggered alerts, performing root cause analysis and identifying false positives.
• Escalate confirmed security incidents to the SOC team for further investigation and response.
• Generate reports and summaries on security events and trends.

Incident Response:

• Participate in incident response activities as needed, providing insights from the SIEM platform.
• Follow established incident response procedures and document events thoroughly.
• Support the SOC team in threat containment, eradication, and recovery efforts.

Industry Certifications

·Technical certifications: CompTIA security+ \ CEH or relevant

·Security Standard frameworks: ISO/NIST/PCI-DSS

·Incident Handling and relevant certification