Cybersecurity - NGSO Consultant - Manager - EY GDS

Senior (CTM – Threat Detection & Response)

KEY Capabilities:

    Experience in working with Splunk Enterprise, Splunk Enterprise Security & Splunk UEBA
    Minimum of Splunk Power User Certification
    Good knowledge in programming or Scripting languages such as Python (preferred), JavaScript (preferred), Bash, PowerShell, Bash, etc.
    Perform remote and on-site gap assessment of the SIEM solution.
o    Define evaluation criteria & approach based on the Client requirement & scope factoring industry best practices & regulations
o    Conduct interview with stakeholders, review documents (SOPs, Architecture diagrams etc.) 
o    Evaluate SIEM based on the defined criteria and prepare audit reports
    Good experience in providing consulting to customers during the testing, evaluation, pilot, production and training phases to ensure a successful deployment.
o    Understand customer requirements and recommend best practices for SIEM solutions. 
o    Offer consultative advice in security principles and best practices related to SIEM operations
o    Design and document a SIEM solution to meet the customer needs
    Experience in onboarding data into Splunk from various sources including unsupported (in-house built) by creating custom parsers
o    Verification of data of log sources in the SIEM, following the Common Information Model (CIM)
o    Experience in parsing and masking of data prior to ingestion in SIEM
o    Provide support for the data collection, processing, analysis and operational reporting systems including planning, installation, configuration, testing, troubleshooting and problem resolution
o    Assist clients to fully optimize the SIEM system capabilities as well as the audit and logging features of the event log sources
o    Assist client with technical guidance to configure end log sources (in-scope) to be integrated to the SIEM
o    Experience in handling big data integration via Splunk
    Expertise in SIEM content development which includes developing process for automated security event monitoring and alerting along with corresponding event response plans for systems
o    Hands-on experience in development and customization of Splunk Apps & Add-Ons
o    Builds advanced visualizations (Interactive Drilldown, Glass tables etc.)
o    Build and integrate contextual data into notable events
o    Experience in creating use cases under Cyber kill chain and MITRE attack framework
o    Capability in developing advanced dashboards (with CSS, JavaScript, HTML, XML) and reports that can provide near real time visibility into the performance of client applications.
o    Experience in installation, configuration and usage of premium Splunk Apps and Add-ons such as ES App, UEBA, ITSI etc
o    Sound knowledge in configuration of Alerts and Reports.
o    Good exposure in automatic lookup, data models and creating complex SPL queries.
o    Create, modify and tune the SIEM rules to adjust the specifications of alerts and incidents to meet client requirement
o    Work with the client SPOC to for correlation rule tuning (as per use case management life cycle), incident classification and prioritization recommendations
o    Experience in creating custom commands, custom alert action, adaptive response actions etc.

Qualification & experience:

    Minimum of 5 to 11 years’ experience with a depth of network architecture knowledge that will translate over to deploying and integrating a complicated security intelligence solution into global enterprise environments. 
    Strong oral, written and listening skills are an essential component to effective consulting.
    Strong background in network administration. Ability to work at all layers of the OSI models, including being able to explain communication at any level is necessary.
    Must have knowledge of Vulnerability Management, Windows and Linux basics including installations, Windows Domains, trusts, GPOs, server roles, Windows security policies, user administration, Linux security and troubleshooting.
    Good to have below mentioned experience with designing and implementation of Splunk with a focus on IT Operations, Application Analytics, User Experience, Application Performance and Security Management
o    Multiple cluster deployments & management experience as per Vendor guidelines and industry best practices
o    Troubleshoot Splunk platform and application issues, escalate the issue and work with Splunk support to resolve issues
    Certification in any one of the SIEM Solution such as IBM QRadar, Exabeam, Securonix will be an added advantage
    Certifications in a core security related discipline will be an added advantage.