L2 Cybersecurity Expert with (UEBA, SIEM, SPLUNK)_Mumbai_Onsite

NTT DATA, Inc.; Mumbai; On-site; INR 250,000 - 400,000; Full time

Job summary

NTT DATA, Inc. is seeking a Splunk UEBA specialist to design, implement, and tune UEBA solutions in a WFO, 5-day workweek in Mumbai. The role focuses on integrating UEBA with Splunk ES/SIEM and data sources, and on investigating behavioral anomalies and high-risk users.

The ideal candidate will possess strong experience in Splunk ES, risk scoring, and AI/ML-based analytics, with willingness to work in rotational shifts.

Qualifications

• Proficient in Splunk Enterprise Security (ES) and UEBA.
• Experience in risk-based alerting and risk scoring.
• Strong knowledge of behavioral analytics and anomaly detection.
• Experience with account takeover detection.
• UEBA model tuning and baselining.
• Understanding of AI/ML-based behavioral analytics.
• Security data-source integration and investigation.

Responsibilities

• Design, implement, configure and manage Splunk UEBA solutions.
• Integrate UEBA with Splunk ES/SIEM and other data sources.
• Monitor, investigate and tune user/entity behavioral anomalies.
• Investigate high-risk users, insider threats and account takeover scenarios.
• Perform threat modelling and risk assessments.
• Develop dashboards/reports for security leadership and CISO review.

Skills

Splunk Enterprise Security (ES)

Risk-Based Alerting

Behavioral Analytics

Account Takeover Detection

UEBA Tuning & Baselining

AI/ML-based Analytics

Security Data-Source Integration

Job description

Work Mode: Work From Office (WFO) – 5 Days

Shift: Rotational Shifts

Key Responsibilities

• Design, implement, configure and manage Splunk UEBA solutions.
• Integrate UEBA with Splunk ES/SIEM and other security data sources.
• Monitor, investigate and tune user/entity behavioral anomalies.
• Investigate high-risk users, insider threats and account takeover scenarios.
• Perform threat modelling and risk assessments.
• Develop dashboards/reports for security leadership and CISO review.

Mandatory Skills

• Splunk Enterprise Security (ES)
• Risk-Based Alerting (RBA) & Risk Scoring
• Behavioral Analytics & Anomaly Detection
• Account Takeover / Compromised Account Detection
• UEBA Model/Anomaly Tuning & Baselining
• Understanding of AI/ML-based behavioral analytics
• Security log/data-source integration and investigation

Candidate Must Be Comfortable With

• Rotational Shifts
• Minimum 4.5 years of relevant experience