Senior Technical Consultant - Network SecOps

Responsibilities:

1. Design and deploy SIEM architectures across on-premises, virtual, and cloud environments, including data ingestion strategy for log forwarders, syslog collectors, and cloud-native telemetry in AWS, Azure, and GCP
2. Configure and design data pipelines and storage tiers for retention, query performance, and compliance requirements, including sizing decisions for high-volume log environments
3. Create custom correlation rules and detection content (Cortex XSIAM BIOC/correlation rules, CrowdStrike NG-SIEM correlation rules, Google SecOps YARA-L rules) tailored to client environments, moving beyond out-of-box use cases to address specific threats and false-positive patterns
4. Develop custom dashboards and SOAR playbooks using metrics, entities, and application views, translating raw log data into views that map to client SOC workflows and executive reporting needs
5. Build and maintain REST API integrations between SIEM/SOAR and EDR (including CrowdStrike Falcon and Cortex XDR), firewall, ticketing, and CMDB platforms, including custom automation scripts and data enrichment configurations
6. Conduct security monitoring assessments for prospective and existing clients, identifying blind spots in log coverage, detection gaps, and alert fatigue drivers
7. Collaborate with clients to optimize and fine tune their deployment and provide guidance to assist with the optimization of the platform
8. Act as a technical resource for troubleshooting and resolving complex SIEM/SOAR related issues during and post-implementation
9. Contribute to project documentation, ensuring clarity and completeness of Solution Designs and As-Built configurations
10. Mentor junior consultants, sharing your SIEM/SOAR knowledge and fostering their technical development
  

Qualifications:

1. 8+ years of hands-on experience with a major SIEM platform (Cortex XSIAM, CrowdStrike Next-Gen SIEM, Google SecOps, Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security) in production environments
2. Experience deploying and administering at least one SOAR platform (Cortex XSOAR, Google SecOps SOAR, CrowdStrike Falcon Fusion, Splunk SOAR, Microsoft Sentinel Automation, Swimlane, Tines)
3. Demonstrated experience deploying and tuning log ingestion pipelines, indexers, and storage tiers, including sizing, retention configuration, and performance troubleshooting
4. Strong grasp of log and telemetry analysis: network, endpoint, identity, and cloud audit data sources
5. Experience building custom correlation rules, detections, and dashboards beyond default configurations
6. Proficient in Python and PowerShell scripting for automation, customization, and playbook development
7. Working knowledge of query languages (XQL, LogScale/CQL, YARA-L, SPL, KQL, or equivalent) and experience integrating diverse data sources into a SIEM
8. Experienced in proactive threat hunting and incident investigations using the MITRE ATT&CK framework, Cyber Kill Chain, NIST Cybersecurity Framework (CSF), and CIS Critical Security Controls to identify adversary TTPs and strengthen detection and response capabilities
9. Experience with cloud-native logging (AWS CloudTrail, Azure Monitor, GCP Audit Logs) is a strong plus
10. Solid understanding of network security, cloud environments, Identity, Linux, Mac, and Windows
11. Strong analytical and troubleshooting capabilities
12. Effective communication skills with the ability to engage with clients and Team members
13. Relevant certifications (CEH, PenTest+, Security+, CISSP, Microsoft SC-200) preferred or equivalent industry certifications are a plus