SIEM Support and Maintenance:

• Provide day-to-day operational support for both ArcSight and Elastic SIEM platforms, ensuring optimal performance and uptime.
• Troubleshoot and resolve issues related to log collection, data ingestion, and rule execution.
• Maintain accurate and up-to-date documentation for SIEM configurations and procedures.

ArcSight and Elastic Expertise:

• Possess in-depth knowledge of ArcSight and Elastic SIEM platforms, including their functionalities, configurations, and best practices.
• Stay informed about the latest updates and features for both platforms to ensure continuous improvement and optimization.
• Assist customers with complex SIEM configurations and incident investigations when needed.

Log Management:

• Monitor log sources and security events generated by both SIEM platforms for potential threats and anomalies.
• Analyze and investigate suspicious activities, escalating critical issues to senior engineers for further action.
• Contribute to the development and maintenance of log management policies and procedures.

Security Incident Response:

• Participate in the incident response process by providing technical support and analysis of security events from both SIEM platforms.
• Assist with containment, eradication, and recovery efforts as required.

Rule and Content Development:

• Create and customize correlation rules to identify and respond to security incidents.
• Develop and enhance content to enrich the detection capabilities of the ArcSight and Elastic platforms.

Collaboration and Communication:

• Collaborate effectively with the SOC team, IT teams, and other stakeholders to ensure smooth operation and efficient security incident response.
• Communicate clearly and concisely, both verbally and in writing, to document issues, solutions, and recommendations.
• Continuous Learning:
• Proactively stay updated on the latest cybersecurity threats, SIEM technologies, and industry best practices.
• Participate in training and development opportunities to enhance your skills and knowledge.