SOC Engineer SIEM CPX

CPX; Abu Dhabi; On-site; AED 180,000 - 320,000; Full time

Job summary

CPX in Abu Dhabi seeks an experienced SOC Engineer, SIEM, with a focus on Splunk and Cribl, to support SIEM management services within the SOC. You will collaborate with the SOC Engineering team, onboarding log sources and ensuring SIEM health checks for analysts and customers.

The role requires 6+ years in SOC operations, strong scripting (Python), and solid cloud/network knowledge to enable efficient log source onboarding and telemetry optimization.

Qualifications

• Bachelor's degree in CS/IT/Cybersecurity or related field.
• 6+ years of SOC operations experience.
• Experience with Splunk SIEM management and Cribl.

Responsibilities

• Assist in delivering SIEM management services within the SOC.
• Support the SIEM Engineering team in resolving common SIEM issues.
• Be the first point of contact for queries from analysts or customers on log sources and SIEM health checks.
• Assist onboarding of new log sources to the SIEM platform.
• Participate in telemetry enhancements within the Splunk environment.
• Support regular system updates to maintain Splunk functionality and security.
• Maintain performance of the Splunk/Sentinel SIEM per best practices.
• Contribute to SOC efficiency through continuous process improvements.
• Provide regular reports on Splunk services and SOC operations.
• Contribute to SOC architecture strategy and Splunk-related initiatives.

Skills

SIEM operations

Python scripting

Cloud & networking

SOC tuning & health checks

Troubleshooting

Communication

Collaboration

Documentation

Education

Bachelor's degree in CS/IT/C Cybersecurity

Tools

Splunk

QRadar

Sentinel

LogRhythm

Cribl

Cribl Admin

Job description

Job Description:

Overview

The SOC Engineer, SIEM, is a technical role focused on supporting the delivery of SIEM management services within the Security Operations Center (SOC). The SOC Engineer collaborates with other members of SOC Engineering, serving as a first point of contact for the resolution of common issues and queries from the analyst team or customers, with a specific focus on log source and SIEM health checks. Although not required to be an expert in any SIEM, this role requires some SIEM experience, certifications, and strong foundations that will contribute to progression into a senior engineer role. Reporting to the Senior SOC Engineering & Architecture Manager, this role is suited for a professional with over 6 years of experience in SOC operations.

Responsibilities

• Assist in delivering SIEM management services within the SOC.
• Support the SIEM Engineering team, in managing and resolving common SIEM issues.
• Act as a first point of contact for queries and issues from the analyst team or customers, particularly relating to log source and SIEM health checks.
• Assist in the onboarding of new log sources to the SIEM platform.
• Participate in enhancing and optimizing telemetry within the Splunk environment.
• Support regular system updates to maintain Splunk functionality and security.
• Contribute to maintaining the performance of the Splunk/Sentinel SIEM according to established best practices.
• Assist in continuous process improvements to increase SOC efficiency and effectiveness.
• Provide regular reports on Splunk services and SOC operations as required.
• Contribute to SOC architecture strategy and implementation initiatives related to Splunk.

Qualifications

Skills:

• Knowledge and experience with any SIEM like Splunk, QRadar, Sentinel, LogRhythm, FortiSIEM and other related technologies such as CRIBL.
• Knowledge and experience Python scripting
• Understanding of cloud and network technologies, essential for efficient log source onboarding.
• Experience in a complex, fast-paced SOC environment.
• Ability to diagnose and troubleshoot log source issues related to cloud and network infrastructures.
• Understanding of SOC operations, cybersecurity principles, and best practices.
• Problem-solving skills and the ability to work under pressure.
• Ability to collaborate effectively with a variety of team members, including interfacing with customers to resolve issues.
• High proficiency in written and verbal communication.

Certifications

• Splunk Certified Admin.
• Azure SC-200
• Cribl Admin
• Other relevant SIEM certifications are advantageous.
• Certifications in cloud or network technologies like AWS Certified Cloud Practitioner, Google Associate Cloud Engineer, Microsoft Certified: Azure Fundamentals, or CCNA would be beneficial.

Educational Experience

• Bachelor's degree in computer science, Information Technology, Cybersecurity, or a related field.
• A minimum of 6 years of experience in SOC operations, with experience in Splunk SIEM management and Cribl.
• Prior experience in a technical role within a SOC or similar cybersecurity environment.