The Senior Technical Consultant is a cybersecurity professional with deep expertise across SIEM and SOAR platforms who supports Enterprise Clients.
Responsibilities
Design and deploy SIEM architectures across on-premises, virtual, and cloud environments, including data ingestion strategy for log forwarders, syslog collectors, and cloud-native telemetry in AWS, Azure, and GCP
Configure and design data pipelines and storage tiers for retention, query performance, and compliance requirements, including sizing decisions for high-volume log environments
Create custom correlation rules and detection content (Cortex XSIAM BIOC/correlation rules, CrowdStrike NG-SIEM correlation rules, Google SecOps YARA-L rules) tailored to client environments, moving beyond out-of-box use cases to address specific threats and false-positive patterns
Develop custom dashboards and SOAR playbooks using metrics, entities, and application views, translating raw log data into views that map to client SOC workflows and executive reporting needs
Build and maintain REST API integrations between SIEM/SOAR and EDR (including CrowdStrike Falcon and Cortex XDR), firewall, ticketing, and CMDB platforms, including custom automation scripts and data enrichment configurations
Monitor and analyse security alerts from SIEM, EDR, NDR and other security monitoring platforms, performing initial investigation, triage, and classification of security alerts to identify potential cyber threats and incidents.
Responsibilities
Monitor and analyse security alerts from SIEM, EDR, NDR and other security monitoring platforms
Perform initial investigation, triage and classification of security alerts to identify potential cyber threats and incidents
Escalate security incidents to Level 2 analysts and relevant stakeholders in accordance with established procedures and SLAs
Conduct initial incident investigation, including log analysis, threat intelligence enrichment and identification of affected systems
Execute pre-approved containment actions in accordance with established Standard Operating Procedures (SOPs)
Garant de la fiabilité et de la performance des environnements Azure de nos clients, en déployant, en automatisant et en sécurisant les services cloud.
Responsibilities
Déployer des infrastructures en Infrastructure-as-Code (IAC) avec Terraform, Bicep, ARM template
Administrer et optimiser les environnements Azure IaaS & PaaS (VMs, réseaux, stockage, sauvegardes, bases de données)
Déployer et configurer des solutions de surveillance et d’observabilité (Azure Monitor, Log Analytics, Sentinel, …) ou alternatives d’autres éditeurs : Splunk, IBM QRadar, etc.
Garantir la conformité des déploiements (Azure Policy, RBAC, …).
Concevoir des solutions en s’intégrant avec l’IAM Microsoft : Azure AD / Entra ID (SAML, OpenID, etc.).
Maintenance corrective et évolutive des systèmes SOC, analyse et rédaction de procédures, tests de non-régression, support aux opérateurs SOC, reporting aux équipes de build.
Responsibilities
Analyser et contribuer aux correctifs sur la configuration de détection (règles et parseurs QRadar).
Mettre à jour l’inventaire de l’outil de contextualisation des incidents.
Rédiger les procédures d’application des correctifs.
Réaliser les tests de non-régression après correctifs.
A seasoned leader guiding customers through complex SOC transformations, driving large-scale programs from log migration to sophisticated detection strategies.
Compensation
$175,200.00 - $240,900.00/yr plus RSUs and bonus
Responsibilities
Serve as the lead strategic advisor and subject matter expert for customers undertaking a full-scale SOC modernization with XSIAM.
Lead multi-national SOC transformation programs, consolidating fragmented detection and response processes into a unified, AI-driven platform.
Direct enterprise-scale XSIAM deployments, guiding customers from initial strategy through to full operationalization.
Devise and oversee comprehensive log ingestion strategies to ensure high-quality data fuels the XSIAM platform.
Architect and implement sophisticated detection strategies and correlation rules to fortify customer defenses against advanced threats.
Design, implement, and maintain SIEM solutions across the enterprise, develop and optimize security architecture frameworks, monitor and respond to security events, and support incident response efforts.
Responsibilities
Design, implement, and maintain SIEM solutions across the enterprise
Develop and optimize security architecture frameworks, policies, and standards
Monitor, analyze, and respond to security events, alerts, and incidents in real time
Create and tune correlation rules, dashboards, and reports within the SIEM platform
Collaborate with IT and security teams to integrate log sources and data feeds into the SIEM environment
Senior Technical Consultant - Network SecOpsNewAHEAD · US
Senior Cybersecurity Engineer – Vulnerability Management & SIEMXcel Engineering · Oak Ridge, US
ABL - Ingeniero SOC N1Capgemini · Mexico+1 more
Incident Response ManagerHapag-Lloyd · Hamburg, Germany