What you’ll be doing
- Migrating log feeds to Splunk using intermediary shipping software, validating parsing, completeness and volumes before and after cutover
- Writing and debugging Python and shell tooling for log collection, forwarding and validation
- Onboarding and tuning log sources (firewalls, EDR, cloud, authentication, proxies)
- Supporting detection rule and use case work alongside a third party
- Working with SOC, IR and threat detection teams on log reliability and detection quality
- Documenting log flows and operational procedures
What we’re looking for
- Strong hands-on security engineering experience across varied projects
- Strong Linux skills and solid programming experience, including Python and debugging code
- Security operations knowledge
- Some SIEM experience (QRadar, Splunk or similar). QRadar isn’t essential, though QRadar migration experience is relevant
- Experience with Fluent Bit or similar log forwarders
- Understanding of log transport (syslog, TCP, UDP, API-based collection)
- Comfortable working with third parties and the wider team
Details
- £600 - £700 P/D Inside IR35
- Hybrid role - 3 days P/W onsite
- Initial 6-Month contract
Nice to have
- architecture or design experience, and Splunk or Cribl exposure.
Rate:
£95/hour
Location:
London
IR35 Status:
Inside
Remote Status:
Hybrid
Industry:
Cybersecurity
Seniority Level:
Mid-Level