Security Analyst III ( IAM Security Engineer

IAM Security Engineer

This role will report to the Identity and Access Management Programs organization within the Information Security function. Role Summary/

Purpose:

Client's IAM (Identity and Access Management) team is leading an initiative to implement enhanced logging and monitoring of access changes across high-risk applications, leveraging technologies such as Splunk and Cortex. The IAM Security Engineer will be responsible for Highly Privileged Access (HPA) Logging and Monitoring. This role partners closely with client's technology teams to onboard applications to the Monitoring Framework which includes determining the applications logging capabilities through the discovery process and onboarding the applications to Splunk.

In addition, the IAM team is leading an initiative to enhance the implementation of a system that identified secret keys across our environment and reports on secrets that are approaching or beyond the required secret key rotation date, based on requirements in our standards. The IAM Security Engineer will be responsible for understanding test cases, executing testing of functionality, and identifying/reporting defects throughout development.

Scope of Services:
Company is requesting Contractor to provide support for the HPA Logging and Monitoring Discovery and Onboarding phases, and testing of functionality for secrets rotation tool. Based on negotiations between the parties, the scope of services to be provided by Contractor shall be limited to those activities described in this Section. Contractor shall provide assistance to Company to accelerate onboarding of Apps to Splunk, and testing of functionality for secrets rotation tool.

The services shall consist of the following:
• Facilitate discovery and engagement with application owners.
• Conduct interviews, working sessions, and document onboarding.
• Document and escalate risk mitigation plan for apps that cannot onboard.
• Coordinate troubleshooting efforts when preparing apps for onboarding.
• Report ongoing status and raise required escalations.
• Analyze log data to identify relevant log events to map to Splunk data models.
• Develop Splunk technology add-ons to properly parse, event type, and tag application security data.
• Test and quality assure Splunk configurations (e.g., confirm appropriate events are in logs and properly mapped to Common Information Model, confirm Splunk standards are followed).
• Release apps to production Splunk team.
• Develop and execute test plans and cases for new application functionality
• Collaborate with developers to reproduce and troubleshoot issues
• Maintain detailed test documentation Required Skills/Knowledge:
• A total of 3 years working experience, with a minimum of 1 years engineering and/or architecture experience in IAM or adjacent Info Sec domains, such as Data Protection or Security Engineering and in lieu of a degree 5+ years of working experience.
• A minimum of 1-year hands-on experience with IAM technologies
• Deep understanding of Splunk Cloud and Splunk Processing Language (SPL)
• Experience working in a cloud (PaaS) environment
• Knowledge of foundational IAM concepts – Authentication, Authorization, RBAC, etc
• Exceptional written and verbal communication skills
• Ability to prioritize work efforts based on risk and project timelines
• Experience working in Agile methodology, leveraging Jira and Jira Align