Description:
- Primarily accountable for overseeing the engineering, development, and maintenance / continuous improvement of threat detection use-cases scenarios within the SIEM (Splunk ES). Additionally, involved in the engineering and development of custom rules in the EDR (CrowdStrike) to swiftly detect potential threats attacks. Another responsibility involves creating transparency of existing detection capabilities by mapping them to the MITRE ATT&CK framework.
- Support in planning and executing regional IT Infrastructure strategy and aligned with company strategy.
- Proactively create, test, and tune new detection use-cases in the SIEM and custom rules in the EDR.
- Review and enhance existing detection use-cases using e.g., Machine Learning or User & Entity Behaviour Analytics (UEBA).
- Map the detection use-cases to the MITRE ATT&CK framework to determine the SIEM monitoring coverage.
- Perform regular updates to threat detection engineering playbooks, processes, and documentations.
- Work closely with the SOC to challenge detection and prevention capabilities.
- Identify and implement SIEM use-cases that address blind spots.
- Coordinate with log onboarding team and SIEM architect to validate new log-sources on-boarded for compliancy, improve performance on SIEM backend.
- Collaboration with Service Operations team to address challenges, process fulfilment, documentations etc, and improvement of Service Operations Quality.
- Provide governance on topic which related to operational stability.
Qualification:
- Intense knowledge in using Splunk Enterprise Security (ES)
- Intense knowledge in developing and tuning detection use-cases (Correlation Searches) in Splunk based on Data Models
- Experience in Machine Learning and Risk Based Monitoring in Splunk is an advantage.
- Ability to analyse and interpret security logs and events to identify potential threats and attack patterns.
- Experience in validating data source compliant using the common interface model (CIM)
- Experience of setting up and utilize data models in Splunk.
- Deep understanding of cyber security concepts to create detection use-cases targeting various phases of attack lifecycle.
- Understanding of MITRE ATT&CK framework and detections of various tactics and techniques
- Experience and capable of creating interactive dashboards, alerts, reports in Splunk.
Experience:
- At least 3 years of experience with demonstrable skillsets in SIEM use-case engineering, with over 5 years of experience in cybersecurity.
- Previous relevant experience working in a security operational role engaging with and responding to a diverse array of internal stakeholders, including senior management.
- Have good emotional intelligence and is a proven team player.
- Good timekeeping ability to cope with a tight deadline and achieve operational objectives.
- Self-motivated with the ability to carry out assigned tasks with minimum supervision.
To apply please click the Apply button or send us your updated profile to
EA Licence No.:18S9405 / EA Reg. No.:R1330864
Percept Solutions is undergoing a growth phase and are on the lookout for talent. Applicants are encouraged to follow Percept Solutions on LinkedIn @ https://www.linkedin.com/company/percept-solutions/ to stay up to date on our upcoming roles and events.
