About the role
SIEM Administration & Monitoring
- Administer and maintain SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, ArcSight, LogRhythm, or Elastic SIEM.
- Monitor security events, alerts, and incidents generated by the SIEM.
- Ensure continuous availability, performance, and health of the SIEM infrastructure.
- Perform platform upgrades, patching, and configuration management.
- Integrate and onboard log sources including:
- Firewalls
- IDS/IPS
- Endpoint security solutions
- Servers and workstations
- Active Directory
- Cloud services (Azure, AWS, GCP)
- Network devices and applications
- Validate log collection, parsing, normalization, and retention policies.
- Troubleshoot log ingestion and data quality issues.
- Design, develop, and optimize security correlation rules and use cases.
- Create dashboards, reports, and threat-hunting queries.
- Reduce false positives through tuning and refinement of detection logic.
- Implement MITRE ATT&CK-based detection capabilities.
- Investigate SIEM-generated alerts and security incidents.
- Support SOC analysts during incident investigations.
- Perform root cause analysis and provide recommendations.
- Coordinate with internal teams for remediation and containment activities.
- Generate security reports for management and audit requirements.
- Support compliance initiatives such as ISO 27001, NIST, HIPAA, PCI-DSS, and SOC 2.
- Maintain documentation of SIEM architecture, use cases, and procedures.
- Integrate SIEM with SOAR tools and security technologies.
- Develop automation workflows to improve SOC efficiency.
- Utilize scripting to automate repetitive administrative tasks.
- Bachelor's degree in Cybersecurity, Information Security, Computer Science, or related field.
- 3+ years of experience in SIEM administration or SOC operations.
- Hands-on experience with one or more SIEM platforms:
- Microsoft Sentinel
- Splunk
- IBM QRadar
- ArcSight
- LogRhythm
- Elastic Security
- Strong understanding of security monitoring and incident response.
- Knowledge of network protocols, Windows/Linux systems, and cloud security.
- SIEM Administration and Analytics
- Log Management and Event Correlation
- Threat Detection and Threat Hunting
- Security Incident Investigation
- Active Directory Security Monitoring
- Firewall and Network Security Monitoring
- KQL, SPL, SQL, or AQL Query Languages
- PowerShell, Python, or Bash Scripting
- MITRE ATT&CK Framework
- SOAR Integration and Automation
- Cloud Security Monitoring (Azure, AWS, GCP)
- Microsoft Certified: Security Operations Analyst (SC-200)
- Microsoft Certified: Azure Security Engineer (AZ-500)
- Splunk Certified Admin / Power User
- IBM QRadar Certified Administrator
- CompTIA Security+
- CEH (Certified Ethical Hacker)
- GIAC Certifications (GCIA, GCIH)
- CISSP (Preferred)