The Security Engineer will deliver by identifying, implementing, and maintaining Information Security toolsets, primarily focused on SIEM, to protect the organization; interfacing with IT Ops to ensure proper security event logging setup; and, where applicable, supporting the Information Security SIEM management needs of PPFA and Affiliates.
Act as a Subject Matter Expert for PPFA’s SIEM (currently Splunk) and be able to configure, manage, operate, and administer the platform from a managed SIEM perspective.
- SIEM Security Monitoring – Provide security monitoring and threat/risk analysis in a 24/7 environment.
- SIEM Event Filtering – Monitor & ensure established processes for event identification are followed, and, where required, make recommendations for new or refined event filtering, ensuring all updates are completed.
- SIEM Event Investigation & Assignment – Monitor & ensure established processes are followed for collecting relevant data and performing the necessary levels of analysis on that data. Ensure events are assigned appropriately.
- Tier II Event Escalations – Follow an established process for handling Tier II escalations, identifying the source of the escalation (MSSP, MSP, Affiliate, or other) and the appropriate triage and documentation processes.
- Creating and maintaining Standard Operating Procedures (SOPs) for the Information Security Ops group, and providing recommendations on security process improvements
- Support and engage on complex security tool-specific tasks with the assistance and guidance of management, vendor & MSSP resources
- Assist in Vulnerability Assessments setup, scanning, analysis, and remediations, working with IT Ops staff and corporate vendors as needed in correcting errors and alerts as found with the IT infrastructure systems.
- Assist in IR incidents as assigned by management
- All other duties as assigned