Cyber Security Architect

Role & responsibilities :

• Extensive hands-on experience with Splunk Enterprise in a large or complex environment.
• Strong experience with Splunk Enterprise Security and SIEM security use cases.
• Practical cybersecurity experience in at least three of the following areas: detection engineering, threat hunting, security operations, incident response, security monitoring, threat intelligence, cloud security monitoring, or identity security monitoring.
• Strong knowledge of Splunk architecture, including indexers, search heads, forwarders, deployment servers, clustering, and monitoring.
• Advanced proficiency in SPL, including complex searches, data correlation, field extraction, optimization, and troubleshooting.
• Experience onboarding and managing high-volume security log sources.
• Experience tuning correlation searches and reducing false positives.

Preferred candidate profile

• Experience with risk-based alerting, security content management, data models, and the Splunk Common Information Model.
• Experience integrating Splunk with SOAR, case-management, threat-intelligence, vulnerability-management, cloud-security, endpoint, and identity platforms.
• Knowledge of MITRE ATT&CK and other relevant cybersecurity frameworks.
• Experience with cloud and SaaS security telemetry from Microsoft Azure, Microsoft 365, AWS, or Google Cloud.
• Experience with Python, PowerShell, shell scripting, REST APIs, or comparable technologies.
• Understanding of infrastructure-as-code, configuration management, source control, and CI/CD practices for SIEM content.
• Experience supporting audit or regulatory logging requirements.

Experience operating large, distributed, or multi-site Splunk environments