Sr Security Automation & Detection Engineer (SIEM/SOAR)

Role : :: Sr Security Automation & Detection Engineer (SIEM/SOAR)

Duration :: Long Term

Job Description ::: Logging

• Experience with deploying log pipeline solutions (e.g., Bindplane, Cribl, Databahn, forwarder agents) and troubleshooting performance
• Experience using webhooks and an understanding of common cloud & security tooling platforms such as AWS, Azure, Microsoft Defender, Crowdstrike, and more.
• Experience using and/or understanding security logs, understanding the difference between security and operational logs, and the fields that matter from a security perspective within security logs
• Ability to understand common logging formats (syslog, JSON, KV, CEF, etc.)
• Experience with creating parsers to normalize log data from disparate formats, ensuring that downstream security needs are met
• Ability to create monitoring/health dashboards across a variety of solutions for scenarios such as silent log sources

Detections

Ability to author and tune risk based alerts and machine based learning techniques (beyond what platforms natively support such as XSIAM or Google SecOps)

• Experience in leading SIEM technologies such as Google SecOps or Palo XSIAM
• Experience in upstream tools with detection suites like CrowdStrike, MSFT Defender, Wiz, Proofpoint, Obsidian

SOAR

Experience in leading SOAR platforms such as Google SecOps SOAR, Palo Alto XSOAR (Demisto), Swimlane, Splunk SOAR (Phantom), etc

• Ability to design, build, and maintain automated playbooks/workflows that orchestrate detection, enrichment, and response actions
• Ability to build and maintain custom integrations/connectors (Python, REST APIs) to extend platform functionality beyond out-of-the-box content
• Experience building and maintaining scheduled Jobs (recurring/batch automation independent of case-triggered playbooks)
• Ability to build custom HTML widgets/visual reporting tied to automation and case data
• Experience with the marketplace/content ecosystem - evaluating, deploying, and customizing pre-built integrations vs. building from scratch

Best Regards

Abdul Samad