Responsibilities
Design, implement, configure, and optimize USM Anywhere SIEM/XDR environments.
Configure and manage security monitoring, log collection, data sources, integrations, agents, and supporting infrastructure.
Develop, tune, and maintain detections, correlation rules, alerts, dashboards, and other security monitoring capabilities.
Support threat detection, investigation, and incident response using SIEM and XDR technologies.
Leverage endpoint, network, cloud, application, and other security telemetry to improve threat visibility and detection.
Troubleshoot complex SIEM, XDR, security, infrastructure, and networking issues and serve as a technical escalation point for other engineers.
Support integrations between USM Anywhere and endpoint, cloud, network, identity, and other security technologies.
Develop automation and scripting to improve operational efficiency and enhance security response capabilities.
Identify opportunities to improve detection quality, system performance, reliability, scalability, and operational processes.
Support the architecture and deployment of new SIEM/XDR environments and customer solutions.
Create and maintain technical documentation, architecture diagrams, procedures, and operational standards.
Collaborate with Security Operations, Engineering, Service Delivery, and other technical teams to resolve complex customer and operational issues.
Participate in change management and CAB processes.
- Stay current with emerging SIEM, XDR, threat detection, automation, and security operations technologies.
- Required Qualifications:
- 5+ years of overall IT experience, including at least 2 years in cybersecurity engineering, security operations, or a related security role.
2+ years of hands-on experience implementing, administering, troubleshooting, or engineering SIEM and/or XDR solutions.
Strong hands-on experience with USM Anywhere or a comparable enterprise SIEM/XDR platform.
Strong understanding of SIEM concepts, including log collection, normalization, correlation, alerting, detection, dashboards, and security event analysis.
Experience developing, tuning, or troubleshooting security detections and understanding the underlying data supporting those detections.
Strong technical troubleshooting and advanced problem-solving skills.
Experience with security automation or scripting using PowerShell, Python, Bash, SQL, or similar technologies.
Foundational understanding of cloud security and infrastructure in AWS and/or Azure.
Working knowledge of networking concepts, including TCP/IP, DNS, VPNs, and IPsec.
Strong written and verbal communication skills.
- #LI-CS1
- Preferred Qualifications:
- Advanced experience with USM Anywhere and/or related LevelBlue security technologies.
Experience with Open XDR and security orchestration, automation, and response (SOAR) capabilities.
Experience with Microsoft Sentinel, SentinelOne, Splunk, FortiSIEM, LogRhythm, or other major SIEM/XDR platforms.
Experience working in an MSSP, managed security services, or professional services environment.
Experience supporting multiple customer environments or multitenant security platforms.
Strong Windows and Linux administration experience.
Experience with SQL, Elasticsearch, or other security data platforms.
Familiarity with MITRE ATT&CK and the NIST Cybersecurity Framework.
Relevant cybersecurity or vendor certifications.
Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field, or equivalent professional experience.
