Crowdstrike NG SIEM and Onum Engineer

Alignity Solutions; Hyderabad; On-site; INR 1,200,000 - 2,200,000; Full time

Job summary

Alignity Solutions is seeking an experienced CrowdStrike NG SIEM and Onum Engineer in Hyderabad/Bangalore. You will administer and support the CrowdStrike Falcon Next-Gen SIEM and Onum platforms, onboard diverse log sources, develop parsers, and manage data pipelines.

You will work with SOC, threat intelligence, and security teams to ensure platform health and effective detections. You should have strong knowledge of CQL, MITRE ATT&CK mappings, and be capable of building dashboards, tuning

Qualifications

• 4+ years in SIEM engineering, administration or security monitoring.

Responsibilities

• Provide architecture analysis and support for CrowdStrike NGSIEM and Onum platforms.
• Onboard log sources (servers, endpoints, AD, firewalls, VPN, cloud) into NGSIEM and Onum.
• Coordinate with client infrastructure and application teams for integrations.
• Develop, test and maintain parsers and normalization for log sources.
• Design and maintain pipelines to ingest, parse, enrich, and route telemetry.
• Create and tune detection rules and alerts using CQL.
• Map detections to MITRE ATT&CK and assess coverage.
• Build dashboards and reports on pipeline health and ingestion metrics.
• Optimize data ingestion to control licensing and storage costs.
• Develop automation and response workflows and integrate with ticketing and threat intel tools.
• Troubleshoot complex SIEM issues across components.
• Create SOPs and onboarding docs; mentor junior engineers.
• Engage with clients and represent the team in meetings.

Skills

SIEM engineering

CrowdStrike NG SIEM

Threat monitoring

Data pipeline

Tools

Falcon Onum

Cribl

Job description

Do you love a career where you Experience, Grow &Contribute at the same time, while earning at least 10% above themarket?If so, we are excited to have bumped onto you.

Learn how we are redefining the meaning of work ,and be a part of the team raved by Clients, Job-seekers and Employees.

If you are a Crowdstrike NG SIEM and Onum Engineer lookingfor excitement, challenge and stability in your work, then you would be glad tocome across this page.

We are an IT Solutions Integrator/Consulting Firm helpingour clients hire the right professional for an exciting long-term project. Hereare a few details.

Check if you are up for maximizing your earning/growthpotential, leveraging our Disruptive Talent Solution.

Role: Crowdstrike NG SIEM and Onum Engineer

Location:HYDERABAD | BANGALORE

Experience: 4+ Years

Employment Type:Contract to hire

Notice Period:0-30 days(If you have negotiable notice period or buyout optionplease apply)

Requirements

You will administer and support the CrowdStrike Falcon Next-Gen SIEM & Falcon Onum platform, including architecture changes, log source onboarding, data pipeline management with Falcon Onum, use-case development and platform health. You will work closely with SOC, threat intelligence, infrastructure and security teams and serve as an advanced escalation point for potential security incidents. Your job responsibilities include:

• Provide architecture analysis, design and support for the platform, including Falcon Onum data pipeline architecture
• Onboard log sources (servers, endpoints, Active Directory, firewalls, VPN, cloud and SaaS platforms, applications and databases) using collectors, syslog, API-based connectors, and custom scripts methods into NGSIEM and Onum.
• Gather onboarding requirements from clients and coordinate with their infrastructure and application teams to complete integrations
• Develop, test and maintain parsers and field normalization for custom and third-party log sources in CrowdStrike NGSIEM
• Design, build and maintain Falcon Onum pipelines to ingest, parse, filter, enrich, transform and route telemetry from third-party sources into Falcon Next-Gen SIEM and other destinations
• Write, tune and manage detection rules, correlation searches and alerts using CrowdStrike Query Language (CQL)
• Drive detection coverage and gap analysis using frameworks such as MITRE ATT&CK
• Build and maintain dashboards, reports and metrics, including log source, pipeline health and ingestion monitoring
• Optimize data ingestion, filtering and retention to manage licensing and storage costs, using Falcon Onum to reduce low-value data and route it to the right destinations
• Develop automation and response workflows (for example, Falcon Fusion) and integrate with ticketing and threat intelligence tools
• Troubleshoot complex issues across the SIEM platform, Falcon Onum pipelines, log collectors, servers, endpoints and networks
• Create and maintain standard operating procedures (SOPs) and onboarding documentation, and submit them through the Quality Review Management process
• Mentor and train junior engineers
• Build relationships with client counterparts and represent the team in client meetings
• Adhere to internal operational security and other Deloitte policies

Qualifications Required:

• Candidate should have overall 4+ years’ experience in SIEM engineering, administration or security monitoring
• Hands-on experience with CrowdStrike Falcon Next-Gen SIEM / LogScale and Falcon Onum.
• Experience onboarding and troubleshooting log sources using agents, syslog, API-based connectors and Falcon Onum pipelines in CrowdStrike Falcon Next-Gen SIEM
• Proficient understanding of common log sources, including Windows Event Logs, Linux syslog, Active Directory, firewall and VPN logs, web server logs, database audit logs and cloud audit logs
• Experience writing detection logic and search queries in CQL, including regular expressions for parsing
• Experience with data pipeline concepts such as filtering, parsing, enrichment, routing and data reduction, ideally using Falcon Onum or comparable tools (for example, Cribl)
• Proficient understanding of IT infrastructure, security technologies and other security tools
• Knowledge of Advanced Persistent Threat (APT) tactics, techniques and procedures, and experience mapping detections to MITRE ATT&CK
• Understanding of common attack activities such as scanning, malicious code, credential attacks and lateral movement
• Understanding of basic networking protocols such as TCP/IP, DNS, HTTP and TLS

Preferred:

• Certifications in CrowdStrike SIEM and other SIEM tools
• Hands-on experience in onboarding logs to Falcon Onum, designing and operating Falcon Onum pipelines, and multi-destination routing
• Excellent interpersonal and organizational skills
• Excellent oral and written communication skills
• Strong analytical and problem-solving skills
• Self-motivated to improve knowledge and skills
• A strong desire to understand what as well as the why and the how of security incidents