The SOC Consultant monitors security events from the various SOC entry channels (SIEM, Tickets, Email and Phone), based on the security event severity, escalate to managed service support teams, tier2 information security specialists, and/or customer as appropriate to perform further investigation and resolution.
- Integration of OS/APP Devices:
- Integrate Linux, Windows, Unix, and other OS devices into the SIEM platform.
- Develop custom parsers and configure data sources for proper log ingestion from various operating systems.
- Collaborate with application teams to onboard and deboard devices and data sources in SIEM.
- Non-Logging Device Monitoring:
- Monitor and troubleshoot non-logging devices to ensure continuous log collection across the environment.
- Develop and optimize automation for identifying and resolving non-logging device issues.
- Implement and maintain scripts for automated log collection service restarts (e.g., rsyslog, Nxlog) to reduce manual intervention.
- Create monitoring spotter queries and configure alerting for devices failing to log correctly.
- Collaboration with Application Owners:
- Work closely with application owners to troubleshoot API, DB, and syslog-based log collection issues.
- Ensure that log collection configurations and connectivity between the OS devices and SIEM log collectors are correctly maintained.
- Automation & Process Optimization:
- Develop automation playbooks for log monitoring and integration workflows using SOAR platforms.
- Create and maintain Standard Operating Procedures (SOPs) for OS device integration and non-logging monitoring activities.
- Continuous Improvement:
- Proactively identify opportunities to improve the monitoring of device integrations and log collection processes.
- 3+ years of experience with SIEM platforms (e.g., Securonix, QRadar, Splunk, etc.).
- Proven experience in integrating various OS devices (Linux, Windows, Unix) with SIEM platforms.
- Experience in non-logging device monitoring and troubleshooting log collection failures.
- Knowledge of log collection protocols (syslog, rsyslog, Nxlog, etc.).
- Strong scripting skills (Python, Shell, PowerShell) for automation tasks.
- Experience with SOAR platforms for automation of monitoring and response playbooks.
- Familiarity with API and DB log collection techniques and troubleshooting.
- Hands-on experience with log ingestion, data source configuration, and monitoring.
· Bachelor’s degree relevant to Information Technology, Computer Science/Engineering (or equivalent).
· Certification (Preferred): Palo-alto XSOAR, CompTIA Security+, AZ-200, AZ-900, SIEM Fundamentals.