Sr. IT Security Engineer (SIEM, NDR )

The Job Description

• Design, deploy, and maintain Splunk Enterprise, and Splunk ES (Enterprise Security) for advanced security analytics.
• Develop and optimize Splunk dashboards, alerts, correlation searches, and threat intelligence integrations.
• Manage Splunk data ingestion pipelines, including log parsing, normalization, and enrichment.
• Integrate and analyze NDR solutions such as Darktrace, ExtraHop, Vectra AI, or Corelight with Splunk.
• Develop custom detections and alerts based on network anomalies, behavioral analysis, and threat intelligence.
• Correlate NDR telemetry with SIEM logs to detect advanced network-based attacks (e.g., lateral movement, C2 traffic).
• Deploy and manage deception technologies such as Illusive Networks, TrapX, Fidelis Deception, or Attivo Networks.
• Integrate honeypots, decoy systems, and fake credentials to lure and detect adversaries.
• Create and fine-tune custom deception campaigns to simulate real-world attack scenarios.
• Automate deception-related alerts and incident response workflows within Splunk ES & SOAR.
• Design correlation rules, SIEM-based threat models, and security detections aligned with MITRE ATT&CK.
• Collaborate with SOC teams to enhance incident detection and response capabilities.
• Conduct log management audits, forensic investigations, and security assessments.
• Document Splunk configurations, runbooks, and security procedures.

Requirements :

#J-18808-Ljbffr