for administration and development of the SIEM system in a large cluster.
Tasks:
- Administration of the SIEM system as part of a large, distributed cluster with multiple installations.
- Connecting new data sources.
- Development and configuration of parsers for processing data from various sources.
- Monitoring the arrival of events and their correct display in the system.
- Integration of the SIEM system with adjacent systems (e.g., incident management systems, identity and access management systems, and others).
- Scaling the system in accordance with the growing needs of the company.
- Optimization of the operation of all system components to improve performance and reliability.
- Development and maintenance of technical documentation, participation in training colleagues from adjacent departments.
- Participation in piloting new information security monitoring solutions.
Requirements:
- Higher education: specialization in information security.
- Work experience in a similar role from 1 year.
- Understanding of the principles of operation and architecture of SIEM systems.
- Experience with SIEM systems (Splunk, ArcSight, QRadar, ELK, and others).
- Understanding of event logging processes in various data sources (system logs, network devices, applications, etc.) and experience in collecting them.
- Experience in writing parsers and working with programming and scripting languages (Python, Bash, PowerShell, etc.).
- Experience in administering Unix and Windows servers.
- Knowledge of network protocols and information security principles.
Skills:
- Splunk
- ArcSight
- QRadar
- ELK
- Python
- Bash
- PowerShell
- Unix
- Windows
