SOC Engineer (SIEM) (CPX)

Showcify, Inc.; Abu Dhabi; On-site; AED 180,000 - 240,000; Full time

Job summary

Showcify, Inc. is seeking a SOC Engineer focused on SIEM management within a Security Operations Center.

The role acts as a first point of contact for analysts and customers, with emphasis on log sources and SIEM health checks, and collaborates with the SIEM Engineering team to on-board new data sources and optimize telemetry. The ideal candidate has over 6 years in SOC operations, familiar with Splunk and Cribl, and holds relevant SIEM certifications.

Qualifications

• Bachelor’s degree in CS, IT, cybersecurity, or related field.
• Minimum 6 years of SOC operations experience with Splunk SIEM management and Cribl.
• Experience in a technical role within SOC or similar cybersecurity environment.
• Strong troubleshooting and problem-solving in fast-paced SOC.
• Excellent written and verbal communication.

Responsibilities

• Deliver SIEM management services within the SOC.
• Support the SIEM Engineering team and resolve common SIEM issues.
• Serve as first point of contact for analyst/customer queries on log source and SIEM health.
• Onboard new log sources to the SIEM platform.
• Enhance telemetry within the Splunk environment.
• Maintain Splunk and Sentinel functionality and security.
• Contribute to SOC architecture strategy related to Splunk.
• Provide regular reports on Splunk services and SOC operations.
• Pursue continuous process improvements to increase SOC efficiency.

Skills

SIEM experience

Splunk

QRadar

Sentinel

LogRhythm

Cribl

Python scripting

Cloud technologies

Network technologies

SOC operations

Communication

Education

Bachelor’s degree in CS/IT/Cybersecurity

Splunk Certified Admin

Azure SC-200

Cribl Admin

AWS Certified Cloud Practitioner

Google Associate Cloud Engineer

Microsoft Certified: Azure Fundamentals

CCNA

Tools

Splunk

QRadar

Sentinel

LogRhythm

FortiSIEM

Cribl

Job description

Overview:

The SOC Engineer, SIEM, is a technical role focused on supporting the delivery of SIEM management services within the Security Operations Center (SOC). The SOC Engineer collaborates with other members of SOC Engineering, serving as a first point of contact for the resolution of common issues and queries from the analyst team or customers, with a specific focus on log source and SIEM health checks. Although not required to be an expert in any SIEM, this role requires some SIEM experience, certifications, and strong foundations that will contribute to progression into a senior engineer role. Reporting to the Senior SOC Engineering & Architecture Manager, this role is suited for a professional with over 6 years of experience in SOC operations.

Responsibilities:

• Assist in delivering SIEM management services within the SOC.
• Support the SIEM Engineering team, in managing and resolving common SIEM issues.
• Act as a first point of contact for queries and issues from the analyst team or customers, particularly relating to log source and SIEM health checks.
• Assist in the onboarding of new log sources to the SIEM platform.
• Participate in enhancing and optimizing telemetry within the Splunk environment.
• Support regular system updates to maintain Splunk functionality and security.
• Contribute to maintaining the performance of the Splunk/Sentinel SIEM according to established best practices.
• Assist in continuous process improvements to increase SOC efficiency and effectiveness.
• Provide regular reports on Splunk services and SOC operations as required.
• Contribute to SOC architecture strategy and implementation initiatives related to Splunk.

Qualifications:

Skills:

• Knowledge and experience with any SIEM like Splunk, QRadar, Sentinel, LogRhythm, FortiSIEM and other related technologies such as CRIBL.
• Knowledge and experience Python scripting
• Understanding of cloud and network technologies, essential for efficient log source onboarding.
• Experience in a complex, fast-paced SOC environment.
• Ability to diagnose and troubleshoot log source issues related to cloud and network infrastructures.
• Understanding of SOC operations, cybersecurity principles, and best practices.
• Problem-solving skills and the ability to work under pressure.
• Ability to collaborate effectively with a variety of team members, including interfacing with customers to resolve issues.
• High proficiency in written and verbal communication.

Certifications:

• Splunk Certified Admin.
• Azure SC-200
• Cribl Admin
• Other relevant SIEM certifications are advantageous.
• Certifications in cloud or network technologies like AWS Certified Cloud Practitioner, Google Associate Cloud Engineer, Microsoft Certified: Azure Fundamentals, or CCNA would be beneficial.

Educational Experience:

• Bachelor’s degree in computer science, Information Technology, Cybersecurity, or a related field.
• A minimum of 6 years of experience in SOC operations, with experience in Splunk SIEM management and Cribl.
• Prior experience in a technical role within a SOC or similar cybersecurity environment.