Key Responsibilities
Platform Operations and Availability
Maintain the availability, performance, and functionality of the Splunk security monitoring platform on a 24/7 basis.
Monitor the health and performance of security platforms, data pipelines, and log ingestion processes.
Develop and maintain monitoring alerts to promptly identify faults, delays, or disruptions in log collection and correlation.
Investigate platform issues and take appropriate action to restore services within the required service levels.
Proactively identify data quality, configuration, and architectural issues that may affect threat detection or introduce security and operational risks.
Log Integration and Data Quality
Identify, map, model, onboard, and correlate event logs from platforms and systems supporting Regional IT Security use cases.
Ensure security event data is complete, accurate, timely, and suitable for monitoring, detection, investigation, and reporting.
Support the integration of new log sources and security technologies into the monitoring platform.
Perform data validation and troubleshooting to resolve issues affecting log collection, parsing, normalisation, enrichment, and correlation.
Support data modelling and analytics activities and research new methods to improve data quality and detection capabilities.
Detection Engineering and Security Monitoring
Develop, maintain, and enhance security monitoring use cases, correlation rules, dashboards, alerts, and detective controls.
Work closely with security analysts to identify, investigate, remediate, and close potential security threats.
Review the effectiveness of monitoring controls and recommend technical improvements where required.
Maintain and enhance threat intelligence data feeds and their integration with security monitoring and correlation processes.
Develop dashboards and controls supporting IT security oversight, control monitoring, assurance, and reporting requirements.
Automation and Engineering
Develop scripts, automation, and technical solutions to improve the efficiency, consistency, and reliability of security operations.
Identify recurring operational activities that can be automated or standardised.
Support the evaluation, proof of concept, implementation, and rollout of security technologies used by the GSOC and LBU BISO teams.
Contribute to initiatives involving Security Orchestration, Automation and Response (SOAR), metrics assurance, and related security capabilities.
Proactively research emerging technologies, engineering practices, and security controls that may improve the organisation’s monitoring and response capabilities.
Technical Support and Stakeholder Engagement
Provide timely technical support to the GSOC and LBU BISO teams for platform issues, service requests, and new integration initiatives.
Manage requests and service tickets in accordance with agreed Service Level Agreements (SLAs).
Provide technical guidance to stakeholders on the effective use of security monitoring platforms and associated capabilities.
Coordinate with LBU BISO teams, infrastructure teams, application owners, security teams, and technology vendors to resolve technical issues and deliver security initiatives.
Liaise with Service Delivery Managers and Security Engagement Managers to communicate project progress, operational matters, risks, dependencies, and business requirements.
Ensure platform changes and deployments are aligned with the organisation’s change management processes.
Documentation and Continuous Improvement
Develop and maintain accurate system documentation, technical procedures, operational processes, configuration records, and support guides.
Develop and maintain Standard Operating Procedures (SOPs) for security engineering activities, roles, and responsibilities.
Analyse recurring incidents and operational issues to identify trends, underlying causes, and opportunities for improvement.
Report recurring problems to management and recommend appropriate process or technical improvements.
Promote knowledge sharing across the team to reduce operational dependency on individual team members and minimise single points of failure.
Work collaboratively with peers to ensure adequate operational coverage, knowledge transfer, and continuity of support.
Minimum Job Requirements
Education and Experience
Bachelor’s degree in Computer Science, Information Systems, Computer Engineering, Cybersecurity, or a related discipline.
Four to seven years of relevant experience in security engineering, platform engineering, systems integration, security operations, or a related technical field.
Relevant professional or technical certifications would be an advantage.
Technical Skills
Hands-on experience with enterprise log management or Security Information and Event Management (SIEM) platforms, preferably Splunk.
Experience interpreting, searching, manipulating, correlating, and tuning security event data within an enterprise log management platform.
Experience with at least one scripting or automation language, such as Python, PowerShell, or Perl.
Good understanding of log collection, data parsing, data normalisation, event correlation, security monitoring, and incident detection concepts.
Experience troubleshooting integrations between applications, infrastructure platforms, security tools, and data collection components.
Familiarity with security monitoring technologies and capabilities such as SIEM, SOAR, EDR, threat intelligence, and cloud security monitoring.
Professional Skills
Strong analytical, troubleshooting, and problem-solving skills.
Self-motivated and able to work independently while collaborating effectively within a team.
Able to work with both technical and non-technical stakeholders across different business units.
Able to learn and apply new technologies, security concepts, and engineering practices quickly.
Strong organisational skills with the ability to manage multiple operational priorities and technical assignments.
Excellent written and verbal communication skills in English.
Able to communicate technical information clearly to stakeholders with different levels of technical knowledge.
Preferred Certifications
The following certifications would be advantageous
Splunk Certified Cybersecurity Defense Engineer
Splunk Enterprise Security Certified Admin
Other relevant cybersecurity, cloud, automation, or platform engineering certifications
Prudential is an equal opportunity employer. We provide equality of opportunity of benefits for all who apply and who perform work for our organisation irrespective of sex, race, age, ethnic origin, educational, social and cultural background, marital status, pregnancy and maternity, religion or belief, disability or part-time / fixed-term work, or any other status protected by applicable law. We encourage the same standards from our recruitment and third-party suppliers taking into account the context of grade, job and location. We also allow for reasonable adjustments to support people with individual physical or mental health requirements.
