Splunk Engineer
Summary
Maintains and optimizes a Splunk-based SIEM system, onboards log sources, develops security use cases, and troubleshoots infrastructure issues in a Singapore-based role.
Job Description
SIEM Infrastructure administration:
- Perform SIEM health check
- Monitor SIEM Server Storage, CPU and Memory Usage and perform necessary action.
- Perform SIEM version upgrade
- Update splunk configurations based on security advisory
- SIEM Infra Tuning and Performance Optimization
- Monitor SIEM data sources proactively to identify issues in the environment (ex: Index Cluster / Search head cluster issues / etc)
SIEM Data onboarding
- Data Onboarding (Including first level assessment, UAT Testing before live)
- Integration numerous logs sources including servers (Windows & Linux), devices and security tools like NAC, PAM, NBAD, IPS DAM, DLP, AV etc.
- Data Parser and CIM Mapping Configuration
SIEM Use Case Development:
- Finetuning existing use cases
- Build new use cases
SIEM Troubleshooting and Splunk servers reconciliation:
- Troubleshoot, investigate and remediate identified SIEM issues
- Monitor and troubleshoot the servers that have stopped reporting
- Troubleshooting issues with search scheduler management
- Search head tuning and optimization, for missed searches, failed jobs and scheduling searches etc.
- Liaise with IT support groups & service providers to resolve outstanding issues such log onboarding (e.g. HF related issue – Core team, source related issue – Cyber team to coordinate)
- Reconcile Splunk servers periodically
SIEM Documentation:
- Prepare/update SIEM tool SOPs
- Update Splunk built documents, whenever there are changes to Splunk deployment architecture
- Prepare/update Splunk guide for agent installations
EA Number: 11C4879