gds consulting_siem splunk Administrator senior consultantErnst & Young Global Services Philippines Inc

Key Responsibilities: * Act as a Splunk enterprise Subject Matter Expert * Architect, design, support, and maintain high availability, distributed, multi-clustered and multi-tenant Splunk deployment * Maintain strategic Splunk architectural Key Responsibilities: Act as a Splunk enterprise Subject Matter Expert Architect, design, support, and maintain high availability, distributed, multi-clustered and multi-tenant Splunk deployment Maintain strategic Splunk architectural development roadmap Responsible for Splunk deployment and server infrastructure analysis, optimization, and capacity planning Responsible for onboarding and maintaining a wide variety of data sources to include various OS, appliance, and application logs Support Splunk on Unix, Linux and Windows-based platforms Perform data analysis using various query and reporting methods Solve/troubleshoot complex integration challenges and configuration issues Create advanced searches, dashboards, visualizations Manage Splunk knowledge objects Create Use cases designed to capture malicious activities, signatures and behaviors. Create custom connectors to integrate with other platforms. Technical writing/creation of formal documentation such as architecture diagrams, technical designs, and SOPs Essential Business Experience and Technical Skills: Required: 3-5 years of general work experience and two (2) years of experience architecting, configuring, deploying, and customizing Splunk. Splunk Administrator Certified or higher Strong understanding of all Splunk architecture components to include search head clustering, indexer clustering, deployment server and monitoring console. Strong understanding of configuration files and relationship between GUI configuration and backend configuration file impact Knowledge of advanced search and reporting commands Strong understanding of (Splunk search processing language) SPL as well as the ability to develop automated search and apps using Python or bash/perl/shell scripting Demonstrated ability to create complex dashboards, forms, and visualizations Understanding of System Log Files and other structured and non-structured data Understanding of IOC and IOA signatures and behaviors. Knowledge of log formats and ability to aggregate and parse log data for syslog, http logs, DB logs etc. for investigation purposes To qualify for the role, you must have Ability to work in 24x7 shifts Strong command on verbal and written English language. Demonstrate both technical acumen and critical thinking abilities. Strong interpersonal and presentation skills. Minimum 4 years of Hands-on experience of operating/implementing SIEM solutions. Certification in any of the SIEM platforms Knowledge of RegEx, Perl scripting and SQL query language. Certification - CCSA, CEH, CISSP, GCIH, GIAC.
Monster

Taguig City, Metro Manila
Permanent
Full-time