SOC - SIEM Admin Specialist

Rebit; Navi Mumbai; In loco; INR 1.200.000 - 2.000.000; Tempo pieno

Descrizione del lavoro

Rebit is seeking a Security Operations Centre – SIEM Admin Specialist to manage and optimize our SIEM infrastructure in Navi Mumbai. You will install, configure, and tune SIEM rules, oversee log sources, and ensure rapid detection of threats.

The role requires 4–6 years in SIEM administration, hands-on experience with Splunk/QRadar/ArcSight, and strong analytical and collaborative skills in a fast-paced environment.

Competenze

• Bachelor's degree in Cybersecurity, IT, or related field (preferred).
• 4–6 years of experience in a SIEM administrator role.
• Proven experience with a leading SIEM platform (e.g., Splunk, QRadar, ArcSight).
• Strong log management principles and network security concepts.
• Proficiency in scripting languages (Python/PowerShell) would be a plus.

Mansioni

• Install, configure, and maintain the SIEM platform according to best practices.
• Manage user access and permissions for the SIEM.
• Perform regular backups and disaster recovery testing.
• Monitor system performance and health; troubleshoot and resolve issues.
• Update SIEM rules and detections to reflect new threats.
• Configure log sources and ensure seamless log collection from network devices, applications, and systems.
• Normalize and enrich log data for effective analysis and correlation.
• Design and implement custom log parsing rules for specific apps or devices.
• Monitor log volume and disk space usage; optimize storage as needed.
• Proactively monitor SIEM alerts and dashboards for potential security incidents.
• Investigate triggered alerts; perform root-cause analysis and identify false positives.
• Escalate confirmed incidents to the SOC team and support incident response.
• Generate reports and summaries on security events and trends.
• Support incident response activities with SIEM insights.

Conoscenze

SIEM administration

Log management

Network security concepts

Python/PowerShell scripting

Analytical skills

Communication skills

Adaptability

Financial domain experience

Formazione

Bachelor's degree in Cybersecurity/IT

Strumenti

Splunk

QRadar

ArcSight

Descrizione del lavoro

JobDescription: Security Operations Centre – SIEM Admin Specialist

Reporting Structure

Reports to Lead –Security Operations Centre

Education

• · Bachelor's degree in Cybersecurity, Information Technology, or arelated field (preferred).

Experience/ Qualifications

• · Minimum of 4 to 6 years of experience in a SIEM administrator role.
• · Proven experience with a leading SIEM platform (e.g., Splunk, QRadar,ArcSight).
• · Strong understanding of log management principles and practices.
• · Working knowledge of network security concepts and protocols.
• · Proficiency in scripting languages (e.g., Python, PowerShell) wouldbe added advantage.
• · Excellent analytical and problem-solving skills.
• · Strong communication and collaboration skills.
• · Ability to work effectively in a fast-paced, dynamic environment.
• · Financial Domain (Banking / NBFC experience is desirable)

Responsibilities

SIEM Management:

• Install, configure, and maintain the SIEMplatform according to best practices.
• Manage user access and permissions for theSIEM.
• Perform regular backups and disasterrecovery testing.
• Monitor system performance and health,troubleshooting and resolving issues.
• Stay up-to‑date on emerging threats andvulnerabilities, updating SIEM rules and detections accordingly.
• Configure log sources and ensure seamlesslog collection from various network devices, applications, and systems.
• Normalize and enrich log data foreffective analysis and correlation.
• Design and implement custom log parsingrules for specific applications or devices.
• Monitor log volume and disk space usage,optimizing storage as needed.

Security Monitoringand Analysis:

• Proactively monitor SIEM alerts anddashboards for potential security incidents.
• Investigate triggered alerts, performingroot cause analysis and identifying false positives.
• Escalate confirmed security incidents tothe SOC team for further investigation and response.
• Generate reports and summaries on securityevents and trends.
• Participate in incident responseactivities as needed, providing insights from the SIEM platform.
• Follow established incident responseprocedures and document events thoroughly.
• Support the SOC team in threatcontainment, eradication, and recovery efforts.

Industry Certifications

• · Technical certifications: CompTIA security+ \ CEH or relevant
• · Security Standard frameworks:ISO/NIST/PCI-DSS
• · Incident Handling and relevantcertification