SIEM Admin / Content Developement - Azure Sentinel

Role & responsibilities

• Requirement gathering from client regarding the new rollout, deployment, or migration from existing SIEM.
• Documentation of requirement and validations of pre-requisites.
• Technical architecture design and test in LAB environment
• Creation and documentation of process and visio flows.
• Technical deployment of the required SIEM tool
• Event source Onboarding as per agreed methods.
• Log collectors deployment and configuration
• Automation of repeated operational activities
• Handover to operations.
• Define and document Log quality criteria.
• Work with vendor on escalated issues.
• Documentation of SOPs, troubleshooting guides, etc.
• Collaborate with stakes holders and peers across the globe through emails or phone call when needed.

Technical Skills-

• Understanding of SIEM architecture and deployment models.
• Technical expertise in Azure sentinel, Q-Radar, LogRhythm, ELK, and other SIEM tools
• Experience in deploying and maintaining syslog collectors.
• Technical and process understanding of onboarding/offboarding of assets and identities to multiple security tools.
• Hand-on experience in writing complex/advanced KQL queries.
• Understanding of Linux operating system.
• Troubleshooting of issues related to event source logging as well as collector issues.
• Data ingestion calculation and reporting.
• Hands-on experience in creating Visio flows.
• Understanding of PowerBI.
• Understanding of Network protocols and communications