Managed Services Consultant

FNRCO; Jeddah; On-site; SAR 180,000 - 240,000; Full time

Job summary

FNRCO is seeking a skilled Managed Services Consultant with hands-on Splunk expertise to administer Splunk Enterprise, ES, and UBA. You will onboard log sources, develop security use cases, and manage SIEM tickets to ensure continuous log ingestion and compliance.

The role requires 5+ years of Splunk/SIEM experience, strong administration skills, and familiarity with threat feeds and regulatory audits in Saudi Arabia.

Qualifications

• Minimum 5 years of Splunk/SIEM experience.
• Hands-on Splunk Enterprise administration expertise.
• Experience with Splunk ES and UBA.
• Knowledge of log onboarding, parsing, SPL, and correlation searches.
• Familiarity with security compliance requirements.

Responsibilities

• Administer Splunk Enterprise: deployment, user management, licensing, upgrades, patches, configuration, change management, reporting, backup, recovery.
• Onboard, monitor, and troubleshoot log sources to ensure continuous log ingestion.
• Develop and maintain security use cases, correlation rules, dashboards, alerts, reports, and SPL queries using Splunk ES.
• Review existing Splunk configurations and recommend enhancements.
• Manage SIEM support tickets and resolve log-source ingestion issues.
• Develop custom parsing rules for non-standard logs.
• Configure threat feeds, IoCs, Sigma rules, and security advisories.
• Support regulatory audits in Saudi Arabia and provide evidence from the SIEM solution.
• Administer Splunk UBA: CIM data, raw events, and HR data ingestion; monitor UBA health.
• Monitor UBA health using the UBA Monitoring App and manage backups/failover procedures.

Skills

Splunk Enterprise

Splunk Enterprise Security

Splunk UBA

SIEM development

SPL queries

Threat intelligence

Job description

We are seeking a skilled Managed Services Consultant with strong hands-on experience in Splunk Enterprise administration, SIEM content development, Splunk Enterprise Security (ES), and Splunk User Behavior Analytics (UBA).

Key Responsibilities

• Administer Splunk Enterprise, including deployment, user management, licensing, upgrades, patches, configuration, change management, reporting, backup, and recovery.
• Onboard, monitor, and troubleshoot log sources to ensure continuous log ingestion.
• Develop and maintain security use cases, correlation rules, dashboards, alerts, reports, report templates, and SPL queries using Splunk Enterprise Security.
• Review existing Splunk configurations and recommend enhancements.
• Manage SIEM support tickets and resolve log-source ingestion issues.
• Develop custom parsing rules for non-standard logs.
• Configure threat feeds, Indicators of Compromise (IoCs), Sigma rules, and security advisories.
• Support regulatory audits in Saudi Arabia and provide the required evidence from the SIEM solution.
• Administer Splunk UBA, including ingestion of CIM-compliant data, raw events, and HR data from the Splunk platform.
• Monitor Splunk UBA health using the UBA Monitoring App and manage backups and failover procedures.

Required Qualifications & Skills

• Minimum 5 years of relevant Splunk/SIEM experience.
• Strong expertise in Splunk Enterprise administration.
• Hands-on experience with Splunk Enterprise Security and SIEM use-case development.
• Knowledge of log onboarding, parsing, SPL queries, and correlation searches.
• Experience in Splunk UBA administration, monitoring, and troubleshooting.
• Understanding of threat intelligence and security compliance requirements.

Nationality Requirements

• Male candidates: All nationalities are welcome.
• Female candidates: Saudi nationals only.