Job Title:  Deputy Manager | Security Information and Event Management (SIEM) | Bengaluru | Cyber Defense & Resi

Work with security teams to understand their requirements and translate them into SIEM use cases

Design, implement, and test SIEM use cases to detect specific types of security threats

Continuously optimize use cases to improve detection accuracy and reduce false positives

Develop and implement SIEM rules and correlation logic to detect security incidents

Tune alerts to minimize false positives and ensure they are actionable

Create and maintaining parsers/connectors in SIEM and SOAR

Set appropriate thresholds for alerts based on analysis and threat intelligence

Ensure data is normalized and enriched for effective correlation and analysis

Develop and maintain log parsing rules to accurately ingest and process data

Maintain detailed documentation of SIEM use cases, including design, implementation, and tuning procedures

Generate reports on the performance and effectiveness of SIEM use cases

Work closely with stakeholders, including SOC analysts, incident responders, and IT teams, to ensure use cases meet their needs

Collaborate with SIEM vendors to troubleshoot issues and implement new features

Innovate and experiment with new use case ideas to enhance the SIEM's detection capabilities

Design and develop automated workflows to address common security operations tasks and incidents

Write and maintain scripts (e.g., Python, PowerShell) to support automation tasks

Create and implement playbooks that automate the response to security incidents.

Develop use cases for automation based on common incident scenarios and threat patterns

Automate the enrichment of security alerts with contextual information to improve decision-making

Integrate various security tools (e.g., SIEM, EDR, ITSM (Service Now), firewalls, Threat intelligence platforms) with the SOAR platform.

Continuously optimize automated workflows to reduce false positives and enhance detection accuracy.

Tune the performance of automated workflows to ensure they operate efficiently and effectively.

Establish a feedback loop with security teams to gather input on automation performance and make necessary adjustments.

Monitor the performance and health of the SOAR platform and automated workflows

Maintain detailed documentation of automated workflows, playbooks, and scripts.

Skills Required

 Proficiency with proposed SOAR and SIEM solutions

Experience in configuring, managing, and optimizing SOAR and SIEM platforms

Strong skills in scripting languages (e.g., Python, PowerShell, JavaScript) for developing automation scripts

Experience in writing and maintaining scripts to automate security tasks and processes

Experience in utilizing RESTful APIs to enable communication between different security tools

Experience in converting MITRE TTPs to Misuse cases for better detection and response

Shall have 7 Years of experience and proposed OEM certifications