Back to jobsLead engineering and optimization of Splunk-based SIEM alerting and monitoring.
Design, develop, and tune correlation rules and detections to reduce false positives.
Own alert lifecycle management including creation, tuning, validation, and retirement.
Design and implement alert enrichment using IAM, CMDB, vulnerability, and threat intelligence sources.
Ensure alerts are enriched with user, asset, privilege, and business context.
Engineer and maintain Splunk data ingestion, normalization, and CIM compliance.
Support onboarding of log sources across endpoint, network, cloud, and identity platforms.
Develop detection use cases mapped to MITRE ATT&CK.
Act as L3 escalation for complex SIEM and detection issues.
Maintain SOPs, runbooks, and SIEM documentation.
Mentor SIEM engineers and provide technical guidance.
