TC CS NGSO TDR Splunk Senior
Bengaluru, KA, IN, 560048
EYMit unseren vier integrierten Geschäftsbereichen — Wirtschaftsprüfung und prüfungsnahe Dienstleistungen, Steuerberatung, Unternehmensberatung und Strategy and Transactions — sowie unserem Branchenwissen unterstützen wir unsere Mandanten dabei,...
At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.
Senior (CTM – Threat Detection & Response)
- Experience in working with Splunk Enterprise, Splunk Enterprise Security & Splunk UEBA
- Minimum of Splunk Power User Certification
- Perform remote and on-site gap assessment of the SIEM solution.
- Define evaluation criteria & approach based on the Client requirement & scope factoring industry best practices & regulations
- Conduct interview with stakeholders, review documents (SOPs, Architecture diagrams etc.)
- Evaluate SIEM based on the defined criteria and prepare audit reports
- Good experience in providing consulting to customers during the testing, evaluation, pilot, production and training phases to ensure a successful deployment.
- Understand customer requirements and recommend best practices for SIEM solutions.
- Offer consultative advice in security principles and best practices related to SIEM operations
- Design and document a SIEM solution to meet the customer needs
- Experience in onboarding data into Splunk from various sources including unsupported (in-house built) by creating custom parsers
- Verification of data of log sources in the SIEM, following the Common Information Model (CIM)
- Experience in parsing and masking of data prior to ingestion in SIEM
- Provide support for the data collection, processing, analysis and operational reporting systems including planning, installation, configuration, testing, troubleshooting and problem resolution
- Assist clients to fully optimize the SIEM system capabilities as well as the audit and logging features of the event log sources
- Assist client with technical guidance to configure end log sources (in-scope) to be integrated to the SIEM
- Experience in handling big data integration via Splunk
- Expertise in SIEM content development which includes developing process for automated security event monitoring and alerting along with corresponding event response plans for systems
- Hands-on experience in development and customization of Splunk Apps & Add-Ons
- Builds advanced visualizations (Interactive Drilldown, Glass tables etc.)
- Build and integrate contextual data into notable events
- Experience in creating use cases under Cyber kill chain and MITRE attack framework
- Experience in installation, configuration and usage of premium Splunk Apps and Add-ons such as ES App, UEBA, ITSI etc
- Sound knowledge in configuration of Alerts and Reports.
- Good exposure in automatic lookup, data models and creating complex SPL queries.
- Create, modify and tune the SIEM rules to adjust the specifications of alerts and incidents to meet client requirement
- Work with the client SPOC to for correlation rule tuning (as per use case management life cycle), incident classification and prioritization recommendations
- Experience in creating custom commands, custom alert action, adaptive response actions etc.
Qualification & experience:
- Minimum of 5 to 11 years’ experience with a depth of network architecture knowledge that will translate over to deploying and integrating a complicated security intelligence solution into global enterprise environments.
- Strong oral, written and listening skills are an essential component to effective consulting.
- Strong background in network administration. Ability to work at all layers of the OSI models, including being able to explain communication at any level is necessary.
- Must have knowledge of Vulnerability Management, Windows and Linux basics including installations, Windows Domains, trusts, GPOs, server roles, Windows security policies, user administration, Linux security and troubleshooting.
- Good to have below mentioned experience with designing and implementation of Splunk with a focus on IT Operations, Application Analytics, User Experience, Application Performance and Security Management
- Multiple cluster deployments & management experience as per Vendor guidelines and industry best practices
- Troubleshoot Splunk platform and application issues, escalate the issue and work with Splunk support to resolve issues
- Certification in any one of the SIEM Solution such as IBM QRadar, Exabeam, Securonix will be an added advantage
- Certifications in a core security related discipline will be an added advantage.
EY | Building a better working world
EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.
Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.
Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.
* Salary range is an estimate based on our InfoSec / Cybersecurity Salary Index 💰
Perks/benefits: Career development
More jobs like this
Explore more InfoSec / Cybersecurity career opportunities
Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.
- Open Information Security Specialist jobs
- Open Senior Information Security Analyst jobs
- Open Senior Security Analyst jobs
- Open Consultant infrastructure sécurité H/F jobs
- Open Staff Security Engineer jobs
- Open Cyber Security Architect jobs
- Open Security Operations Engineer jobs
- Open Cyber Security Specialist jobs
- Open Cybersecurity Analyst jobs
- Open Consultant SOC / CERT H/F jobs
- Open Product Security Engineer jobs
- Open Principal Security Engineer jobs
- Open Cybersecurity Consultant jobs
- Open Senior Information Security Engineer jobs
- Open IT Security Analyst jobs
- Open Information Systems Security Officer (ISSO) jobs
- Open Senior Cyber Security Engineer jobs
- Open Cybersecurity Specialist jobs
- Open Chief Information Security Officer jobs
- Open Senior Security Architect jobs
- Open Security Specialist jobs
- Open Senior Penetration Tester jobs
- Open Ingénieur DevSecops H/F jobs
- Open Security Researcher jobs
- Open Information System Security Officer (ISSO) jobs
- Open C-related jobs
- Open Network security-related jobs
- Open Agile-related jobs
- Open ISO 27001-related jobs
- Open CISM-related jobs
- Open Pentesting-related jobs
- Open Application security-related jobs
- Open Analytics-related jobs
- Open Vulnerability management-related jobs
- Open GCP-related jobs
- Open IAM-related jobs
- Open CISA-related jobs
- Open DevOps-related jobs
- Open SaaS-related jobs
- Open Threat intelligence-related jobs
- Open Security Clearance-related jobs
- Open Security assessment-related jobs
- Open Java-related jobs
- Open Malware-related jobs
- Open Kubernetes-related jobs
- Open CI/CD-related jobs
- Open Splunk-related jobs
- Open EDR-related jobs
- Open APIs-related jobs
- Open DevSecOps-related jobs