At EY youll have the chance to build a career as unique as you are with the global scale support inclusive culture and technology to become the best version of you. And were counting on your unique voice and perspective to help EY become even better too. Join us and build an exceptional experience for yourself and a better working world for all.
Staff (CTM Threat Detection & Response)
KEY Capabilities :
- Experience in working with Splunk Enterprise Splunk Enterprise Security & Splunk UEBA
- Minimum of Splunk Power User Certification
- Good knowledge in programming or Scripting languages such as Python (preferred) JavaScript (preferred) Bash PowerShell Bash etc.
- Assist in remote and on-site gap assessment of the SIEM solution.
Work on defined evaluation criteria & approach based on the Client requirement & scope factoring industry best practices & regulations
Assist in interview with stakeholders review documents (SOPs Architecture diagrams etc.)Asist in evaluating SIEM based on the defined criteria and prepare audit reportsGood experience in providing consulting to customers during the testing evaluation pilot production and training phases to ensure a successful deployment.Experience in onboarding data into Splunk from various sources including unsupported (in-house built) by creating custom parsersVerification of data of log sources in the SIEM following the Common Information Model (CIM)
Experience in parsing and masking of data prior to ingestion in SIEMProvide support for the data collection processing analysis and operational reporting systems including planning installation configuration testing troubleshooting and problem resolutionAssist clients to fully optimize the SIEM system capabilities as well as the audit and logging features of the event log sourcesAssist client with technical guidance to configure their log sources (in-scope) to be integrated to the SIEMExperience in SIEM content development which includes :Hands-on experience in development and customization of Splunk Apps & Add-Ons
Builds advanced visualizations (Interactive Drilldown Glass tables etc.)Build and integrate contextual data into notable eventsExperience in creating use cases under Cyber kill chain and MITRE attack frameworkCapability in developing advanced dashboards (with CSS JavaScript HTML XML) and reports that can provide near real time visibility into the performance of client applications.Sound knowledge in configuration of Alerts and Reports.Good exposure in automatic lookup data models and creating complex SPL queries.Create modify and tune the SIEM rules to adjust the specifications of alerts and incidents to meet client requirementExperience in creating custom commands custom alert action adaptive response actions etc.Qualification & experience :
Minimum of 3 years experience in Splunk and 3 to 5 years of overall experience with knowledge in Operating System and basic network technologiesExperience in SOC as L1 / L2 Analyst will be an added advantageStrong oral written and listening skills are an essential component to effective consulting.Good to have knowledge of Vulnerability Management Windows Domains trusts GPOs server roles Windows security policies user administration Linux security and troubleshootingCertification in any other SIEM Solution such as IBM QRadar Exabeam Securonix will be an added advantageCertifications in a core security related discipline (CEH Security etc.) will be an added advantage.EY Building a better working world
EY exists to build a better working world helping to create long-term value for clients people and society and build trust in the capital markets.
Enabled by data and technology diverse EY teams in over 150 countries provide trust through assurance and help clients grow transform and operate.
Working across assurance consulting law strategy tax and transactions EY teams ask better questions to find new answers for the complex issues facing our world today.
Key Skills
Computer Science,Docker,Kubernetes,Python,VMware,C / C++,Go,System Architecture,gRPC,OS Kernels,Perl,Distributed Systems
Employment Type : Full-Time
Experience : years
Vacancy : 1