SIEM Expert

Role overview

Security monitoring and response

• Configure, manage, and optimize Splunk Enterprise Security for security monitoring and threat detection.
• Develop and manage security use cases and alerts; analyze events to identify threats and suspicious activity.
• Support incident detection, investigation, and response.
• Configure Phantom SOAR and create automated workflows or playbooks to improve response and reduce manual effort.

Integrations and operations

• Integrate Splunk and SOAR platforms with security tools and systems.
• Maintain security dashboards, alerts, and monitoring processes; troubleshoot monitoring and automation issues.
• Use Python, PowerShell, or similar scripting languages for automation and customization.
• Collaborate with cybersecurity, infrastructure, network, and technical teams; maintain technical documentation.

Required experience and skills

• Strong hands-on experience with Splunk Enterprise Security (ES).
• Experience with Phantom SOAR or another SOAR platform, and implementing and managing security use cases and alerts.
• Strong understanding of SOC and incident-response processes; knowledge of SIEM, security monitoring, and threat detection.
• Scripting and automation skills using Python, PowerShell, or similar languages; experience integrating security tools and platforms.
• Strong analytical and troubleshooting skills, with good communication and collaboration skills.

Preferred qualifications

• A bachelor's degree or higher in computer science, information technology, cybersecurity, or a related field is preferred.
• Splunk Certified Admin and Splunk Enterprise Security Certified Admin are preferred; relevant security operations, incident response, SIEM, or SOAR certifications are also noted.

Pay

• Pay is AED 5,000 to AED 10,000 per month.

Work location

• Work location is in person.