Splunk/SIEM Engineer (Remote)
已发布 2 几个月前
详情
补偿
未披露
工业
IT Services and IT Consulting
时间承诺
全职
公司规模
在51和200之间
职位描述
DescriptionOur History:From our start in 2009, Conexess has established itself in 3 markets, employing nearly 200+ individuals nation-wide. Operating in over 15 states, our client base ranges from Fortune 500/1000 companies to mid-small range companies. For the majority of the mid-small range companies, we are exclusively used due to our outstanding staffing track record.Who We Are:Conexess is a full-service staffing firm offering contract, contract-to hire, and direct placements. We have a wide range of recruiting capabilities extending from help desk technicians to CIOs. We are also capable of offering project-based work.Conexess Group is aiding a large healthcare client in their search for a Security Engineer in a remote capacity. This is a long-term opportunity with a competitive compensation package.Responsibilities:
- Understand data feeds of various security tools and logs that feed the SIEM & UBA technologies. Ability to identify capabilities and quality of these feeds and recommend improvements.
- Ability to craft new content use cases based on: threat intelligence, analyst feedback, available log data, and previous incidents.
- Create cost effective SPLUNK ES content
- Perform day to day activities of the content life cycle, including creating new use cases, testing content; tuning, and removing content; and maintain associated documentation.
- Work with the other security teams and product SMEs to identify gaps within the existing analytical capability.
- Development of parsers/field extractions to facilitate reliable content development.
- Development of custom scripts as required to augment default SIEM functionality.
- Participate in root cause analysis on security incidents and provide recommendations for future detection.
- Create, implement, and maintain novel analytic methods and techniques for content incident detection.
- Ensure documentation for content is available on team confluence or other tracking mechanism- specifically including content roadmap and documentation on current content.
- 30% creating/tuning content (must have knowledge of this)
- 20% documentation
- 50% validating content for project (We are replacing Qradar and Splunk on-prem with Splunk cloud)
- 4+ years of experience supporting a Splunk Enterprise Security developing correlations, notables and dashboards.
- Excellent knowledge of security methodologies, processes (i.e., Cyber Kill Chain/Diamond Models, and the MITRE ATT&CK framework).
- Splunk Core Certified Power User. / Splunk Core Cert is a must have
- Experience building and prioritizing RBA content.
- Experience with Agile methodologies.
- Understanding of various log formats and source data for SIEM Analysis.
- Solid background with Windows and Linux platforms (security or system administration).
- Strong incident handling/incident response/security analytics skills.
- Demonstrated history of innovation and/or creativity.
- Knowledge of programming/scripting fundamentals (nice to have)
如何获得客户的聘用？
01
报名参加
通过与我们分享您的个人和专业细节，创建一个档案。
02
评估
参加我们的在线人才评估，进行技能和能力的评估。
03
提供
匹配到需要的工作，加速您的自由职业。
