Security Information and Event Management; SIEM Engineer

Overview

Analyzes security event data for attack patterns and attacker tactics; creates automated log correlations in a SIEM to identify anomalous and potentially malicious behavior; interprets IOC’s and uses them efficiently for alerting; creates technical documentation around the content deployed to the SIEM; determines and improves the fidelity of correlation rules to reduce false positives; recognizes patterns and inconsistencies that could indicate complex cyber-attacks;

develops SIEM correlation rules to detect new threats beyond current capabilities; manages appliance or virtual appliance OS and SIEM software; creates innovative solutions to automate and reduce time frames for operational changes as well as the initial installation of the platform; creates rules for compliance and audit requirements; creates and manage Watch Lists for current threats; performs formal Architectural Review; creates custom rules/rule modifications and custom reports/report modifications as needed;

adds/removes log sources and troubleshoots issues with log sources or systems with the vendor, and report system defects as needed; manages product enhancement/feature requests with vendors as needed; performs software upgrades, updates, and patches as needed; assists with designing and documenting work processes within the SOC.

• Develop and optimize SIEM correlation rules to detect threats and reduce false positives.
• Manage SIEM appliance/OS and software, including installations, upgrades, patches, and configurations.
• Create technical documentation for SIEM content and deployment.
• Design and implement automated log correlation, log source onboarding, and threat intelligence integration (IOC usage).
• Develop compliance and audit-related rules and manage Watch Lists for current threats.
• Perform architectural reviews and propose operational improvements for SOC processes.
• Produce custom rules, rule modifications, and custom reports as required.
• Add or remove log sources, troubleshoot vendor-related issues, and report defects as needed.
• Coordinate with vendors on product enhancements and feature requests.
• Support work process design documentation within the SOC.

Education:

Bachelor 0s Degree in Engineering, Computer Information or Information Technology, Cybersecurity or Information Assurance or equivalent work experience of 5 or more years.

• GIAC Defensible Security Architecture (GDSA)
• GIAC Certified Detection Analyst (GCDA)
• GIAC Certified Incident Handler (GCIH)
• GIAC Security Operations Certified (GSOC)
• GIAC Continuous Monitoring Certification (GMON)