Description

You will manage Splunk and Microsoft Sentinel environments to drive security operations enablement.

Responsibilities

• Administer Splunk Enterprise or Splunk Cloud, optimizing forwarders, CIM normalization, dashboards, and alerts.
• Create SOX and Non-SOX alerts for various applications and operating systems per SLA.
• Manage agent installation and Heavy/Universal forwarder infrastructure across Windows and Linux.
• Administer Microsoft Sentinel workspaces, analytics rules, and automation rules, integrating Defender Suite and Azure logs.
• Support SOC teams by building detections aligned to MITRE ATT&CK and tuning existing rules.

Required Skills

• 12+ years of experience in security operations or IT administration.
• Expert proficiency with Splunk administration and configuration.
• Strong experience administering Microsoft Sentinel, including KQL querying.
• Proficiency in scripting languages such as Python and PowerShell.
• Experience with automation platforms like Cyware SOAR and Logic Apps.
• Familiarity with compliance frameworks including SOX, ISO 27001, and NIST CSF.
• Experience migrating SIEM platforms (Splunk to Sentinel).
• Knowledge of data ingestion pipelines and indexing performance monitoring.

Key Skills

Education

Any Gradute