Security Architect (SIEM) - Remote Remote

Responsibilities

• Lead the design, deployment, and configuration of SIEM solutions, ensuring seamless integration with various security tools, systems, and log sources
• Plan and execute SIEM migration projects, including data transfer, log source integration, rule/alert migration, and configuration tuning
• Develop, customize, and fine-tune SIEM use cases, correlation rules, dashboards, and reports to effectively detect threats and suspicious activities
• Integrate diverse log sources such as firewalls, IDS/IPS, antivirus, cloud services, applications, and operating systems into the SIEM for comprehensive monitoring
• Collaborate with the SOC team to support further use case creation and fine-tuning following SOC team requirements
• Regularly review and optimize SIEM performance to ensure efficient log collection, storage, processing, and alerting
• Maintain comprehensive documentation for SIEM configurations, integrations, and migration processes, providing regular reports on SIEM performance
• Train and mentor junior security engineers and SOC analysts on SIEM use, best practices, and troubleshooting
• Work closely with IT, security, and network teams to ensure the SIEM platform aligns with security strategies and goals

Requirements

• At least 8 years of experience in Cyber Security, with a specialization in engineering SIEM solutions and working in a SOC
• Expertise in SIEM engineering and architecture, with a focus on at least Splunk or any other leading SIEM solutions like Microsoft Sentinel, QRadar, ArcSight, LogRythm
• Experience in managing the full delivery lifecycle for SIEM enhancements and automation including working on converged SIEM solutions that include SOAR and XDR solutions within it
• Proficiency in integrating log sources and developing correlation rules, alerts, and dashboards
• Experience working in cloud environments (AWS, Azure, GCP) and integrating cloud logs into SIEM solutions
• Understand security frameworks (MITRE ATT&CK, NIST) and possess basic knowledge of regulatory compliance (GDPR, PCI-DSS)
• Knowledge of network protocols, firewalls, IDS/IPS, endpoint security, and threat intelligence
• Comprehend the client’s needs, their specific security challenges, and the regulatory landscape to provide tailored solutions
• Effectively communicate complex technical concepts to clients, build trust, and establish strong relationships
• Manage stakeholders at various levels, from technical staff to senior executives
• Collaborate effectively with teams from different departments within large organizations and enterprises
• Facilitate discussions, resolve conflicts, and build consensus among stakeholders with diverse perspectives
• Make informed decisions based on evidence

We offer

• Medical, Dental and Vision Insurance (Subsidized)
• Health Savings Account
• Flexible Spending Accounts (Healthcare, Dependent Care, Commuter)
• Short-Term and Long-Term Disability (Company Provided)
• Life and AD&D Insurance (Company Provided)
• Employee Assistance Program
• Unlimited access to LinkedIn learning solutions
• Matched 401(k) Retirement Savings Plan
• Paid Time Off – the employee will be eligible to accrue 15-25 paid days, depending on specific level and tenure with EPAM (accrual eligibility may change over time)
• Paid Holidays - nine (9) total per year
• Legal Plan and Identity Theft Protection
• Accident Insurance
• Employee Discounts
• Pet Insurance
• Employee Stock Purchase Program
• If otherwise eligible, participation in the discretionary annual bonus program
• If otherwise eligible and hired into a qualifying level, participation in the discretionary Long-Term Incentive (LTI) Program