ArcSight SME / ArcSight Security Engineer

Role Summary

• We are looking for an experienced ArcSight SME / Security Engineer responsible for ArcSight platform engineering, log onboarding, content development, detection engineering, and SIEM optimization.

Key Responsibilities

• Implement, administer, and optimize ArcSight ESM, Logger, Transformation Hub, SmartConnectors, and ArcMC.
• Provide Tier-3 support for complex platform, integration, and operational issues.
• Onboard applications, OEM tools, network devices, databases, servers, and cloud platforms.
• Develop FlexConnectors, parsers, field extractions, mappings, and normalization aligned with common schemas.
• Assess, plan, and optimize log ingestion performance (EPS / GB per day).
• Maintain visibility of devices integrated with SOC versus CMDB inventory.
• Document log types enabled for assets and application log collection details.
• Identify and document reasons for non-integrated devices and define compensating log sources where required.
• Develop advanced Correlation Rules, Filters, Data Monitors, Active Lists, Dashboards, and Reports.
• Design detections for APTs, privilege escalation, lateral movement, credential abuse, malware, ransomware, and cloud threats.
• Collaborate with SOC teams to tune alerts and reduce false positives.
• Support threat hunting, incident investigations, and detection gap assessments.

Required Skills

• ArcSight ESM, Logger, SmartConnectors and FlexConnectors.
• Log management, parsing, normalization, and correlation rule development.
• Syslog, CEF, JSON, XML, Regex, and event normalization.
• SIEM operations, Threat Detection, Incident Response, and SOC processes.
• Strong troubleshooting, analytical, and documentation skills.

Experience

• 5+ years in Cyber Security with at least 3+ years of hands-on ArcSight Engineering and Administration experience.

Role Level

• Senior Security Engineer / ArcSight SME / ArcSight Engineering Lead