L3 SIEM Engineer

The Senior Security Information and Events Management [SIEM] Engineer will be responsible for the maintaining, configuring, optimizing and reporting on the SIEM. The Senior SIEM Engineer is expected to collaborate with leadership to develop metrics based on situational awareness and threat monitoring at an enterprise level that will be reported based on the approved plan and supporting checklists. The focus of this position will be on the Microsoft Azure Sentinel platform. Overview: Manages the functionality and efficiency of the SIEM infrastructure Maintains the integrity and security of servers and systems. Sets up administrator and service accounts. Maintain system documentation and standard operating procedures. Makes recommendations to purchase hardware and software, coordinates installation and provides backup recovery. Develops and monitors policies and standards for allocation of SIEM resources. Provides advice and training to end-users. Provides guidance and work leadership to less-experienced staff members and may have supervisory responsibilities. Maintains current knowledge of relevant technologies as assigned. Participates in special projects as required. Deploy new SIEM logging, playbooks, device connectors as required to collect data feeds. Provide capability to analyse SIEM output and interpret reports. Integration of data feeds (logs) into SIEM. Perform content development to properly identify data feeding to the SIEM. Develop filters to assist in the identification of significant events. Develop reports (manual and automated) to support the development, collection, and reporting of quality assurance and performance metrics (as defined by the client) . Develop dashboards/reports for external customers for system monitoring. Provide ad-hoc training to analysts focusing on specific client missions, including generic SIEM training sessions and Custom Use Case training sessions. Provide recommendations and implement changes to optimize SIEM products in the customer environment. Support the client in fact finding or case supporting tasks as it relates to SIEM. Evaluate relative SIEM product advancements and provide recommendations to the customer. Identifies security risks, threats and vulnerabilities of networks, systems, applications and new technology initiatives. Provides technical support in the monitoring of firewalls, intrusion detection systems, and enterprise anti-virus and software deployment tools. Conducts complex security architecture analysis to evaluate and mitigate issues. Develops implements, enforces and communicates security policies and/or plans for data, software applications, hardware and telecommunications. Acts as team lead, managing and mentoring efforts of junior engineers. Develops capacity planning for entire SIEM infrastructure over 3 years. Able to implement an Azure Sentinel SIEM solution end to end with the ability to leverage cost efficiencies from the Azure stack.