Coalfire is hiring a
Junior Splunk Engineer, Remote - United States

Summary

The job is for a SIEM Engineer I at Coalfire within the Managed Services group. The role involves providing 24x7x365 security monitoring, analyzing security events, maintaining records of activities, administering and monitoring various security tools, integrating security tools using different data sources, designing and building environment-specific rules, alerts, and dashboards in SIEM tooling, communicating alerts to team members and clients, developing technical documentation, participating in on-call rotations, conducting testing and data reviews, assisting with administration and maintenance of SIEM, Log Management, and Data Analytical Platform, scheduling and running regular technical changes, aiding customer-initiated requests, creating and maintaining standard operating procedures, technical documents, and troubleshooting guidelines of security solutions, configuring and troubleshooting managed security devices, developing technical solutions to automate repeatable tasks, opening and following up on tickets with 3rd party vendors, utilizing tools and analytical skills to investigate the root cause of issues across technologies, onboarding new data sources, developing alerting, conducting security investigations, responding to incidents, and deploying security solutions in a rapidly growing environment.

Requirements

• BS or above in related Information Technology field or equivalent combination of education and experience
• 1-2 years experience in 24x7x365 production security operations
• 1-2 years experience administering and operating security tooling such as SIEM, IDS, and endpoint protection
• 2+ years of hands on technical experience supporting cloud operations and automation in Azure, AWS, and/or GCP
• Experience with ITSM solutions such as Jira and ServiceNow
• Certifications such as Splunk Enterprise Certified Admin/Splunk Power User or ELK Certification
• Experience configuring, implementing, and supporting Splunk Enterprise components deployed in the Cloud
• Understanding of regular expression and query languages
• Practical experience in administration of Linux infrastructure
• Experience in Information Security with a focus on incident response and security engineering
• Experience analyzing events or incidents to triage the issue, find the root cause through log and forensic analysis, and determine security vulnerabilities, attacker exploit techniques, and methods for their remediation
• Experience developing playbooks, run books, troubleshoot technical issues, and recognize and identify patterns
• Experience with AWS and vendor SaaS Integrations
• Experience with automation, building security, and/or deploying tools
• Excellent communication, organizational, and problem-solving skills in a dynamic environment
• Effective documentation skills, to include technical diagrams and written descriptions
• Ability to work independently and as part of a team with professional attitude and demeanor

Responsibilities

• Provide 24x7x365 security monitoring for multiple clients while working closely with DevOps and product teams
• Work across a myriad of technology stacks in leading cloud providers like AWS, Azure, and GCP
• Analyze security events using logs and open-source knowledge to determine legitimate or false positive nature
• Maintain a record of security monitoring activities via case management and ticketing technologies
• Administer and monitor intrusion detection, file integrity, endpoint protection, log management and SIEM solutions
• Integrate security tools using a wide variety of data sources that use various protocols
• Design, build, and maintain environment-specific rules, alerts, and dashboards in SIEM tooling via custom queries
• Consult with clients to customize and configure SIEM tools in order to meet security and compliance requirements
• Communicate alerts to team members and clients related to security anomalies in the environment
• Apply technical writing skills to create formal documentation such as analytical reports and briefings
• Develop and maintain standard operating procedures and training materials
• Participate in on-call rotations as needed to support client operational needs that may lay outside of business hours
• Conduct testing and data reviews to evaluate the effectiveness of current security and operational measures
• Assist with administration and maintenance of SIEM, Log Management, and Data Analytical Platform
• Schedule and run regular technical changes such as version updates, security patches, major software releases following best practices for change management policies and procedures
• Aiding customer-initiated requests such as Log Source configuration, App installation, Data Parsing, Use Case Development, and Troubleshoot complex issues for managed technologies