Sr. SIEM Engineer, Splunk | Remote, USA

Optiv Security - Houston, TX

Full-time - Mid Level

Houston, TX

Professional, Scientific, and Technical Services

About the position

The Sr. SIEM Engineer at Optiv plays a crucial role within the Security Operations Center, focusing on managing and maintaining security systems for both internal and client environments. This position involves creating procedures, implementing processes, and developing staff to ensure effective security operations. The engineer will collaborate with various teams to deliver critical services to Managed Security Service clients and will act as a primary responder for client configuration issues.

Responsibilities

• Help lead the Splunk team by prioritizing client work requests, projects, and service tasks.
• Work closely with Management, Service Delivery, and Principal Engineers in defining processes and procedures for internal projects.
• Analyze and identify areas of improvement with existing processes, procedures, and documentation.
• Assist in team development by defining strategies and responsibilities to be successful and grow.
• Develop internal training methods to support Managed Services and their clients.
• Act as a point of escalation for Junior SIEM Engineers, providing guidance and mentorship.
• Assist with client activation and onboarding.
• Explain and demonstrate how to use SIEM products to both technical and non-technical personnel.
• Provide remote consulting services via interactive client sessions to assist with implementation of multiple product vendors and technologies.
• Implement and configure SIEM software and appliance-based products in Enterprise and Government environments.
• Develop, deploy, and tune SIEM content and reporting.
• Interact appropriately and professionally with both customers and partners, when required.
• Perform knowledge transfers and train clients regarding security and system configuration.

Requirements

• 5+ years professional experience managing and maintaining SIEM systems.
• 2-3 years professional experience working with networks and network architecture.
• 1+ year professional experience writing SIEM content specifically for Splunk.
• Ability to deal confidently with complex technical problems.
• Expert-level knowledge of Splunk Enterprise Security.
• Experience with building intricate searches from disparate data sources and joining them together.
• Extensive experience using the Enterprise Security Asset & Identity and Threat Intelligence Framework within Splunk Enterprise Security.
• Proficient with managing Unix and Linux operating systems.
• Strong experience with writing complex regular expressions (Regex) to extract fields for data that is structured and unstructured.
• Experience with extracting fields, multi-value fields, tags, field aliases, etc.
• Well-versed in building threat detections (correlation rules) using security logs to detect malicious activity with high fidelity.
• In-depth knowledge of security logging for Linux, Windows, major EDRs, Firewalls, & Active Directory.
• Experience with installing and configuring Splunk CORE and Splunk Enterprise Security.
• Ability to aggregate and analyze logs from various deployed security devices.
• Experience with configuring and/or working with Splunk Search Head and/or Indexer Clusters.
• Experience with creating custom applications, dashboards, reports, and alerts (not including the default ones that come with Splunk).
• Shift flexibility, including the ability to provide on-call support when needed.
• Experience working with Internal and client Ticketing and Knowledge Base Systems for Incident and Problem tracking as well as procedures (i.e. Jira, Confluence, etc.).
• General security knowledge (GIAC, CISSP, CCSE, CISA, HBSS, NSA, CEH, CCNA Security, Security+, or other security certifications).
• Knowledge of Linux and Windows Operating Systems.
• An understanding of a wide array of server-grade applications such as: DBMS, Exchange, DNS, SMTP, IIS, Apache, SharePoint, Active Directory, Identity Management, Patch Management, LDAP, SQL, and others.
• Familiarity with DevOps.
• Prior consulting experience.

Benefits

• A company committed to championing Diversity, Equality, and Inclusion through Employee Resource Groups.
• Work/life balance
• Professional training resources
• Creative problem-solving and the ability to tackle unique, complex projects
• Volunteer Opportunities through "Optiv Chips In" which encourages employees to volunteer and engage with their teams and communities.
• The ability and technology necessary to productively work remotely/from home (where applicable)