Security Analyst

Job Summary: We are seeking highly skilled and motivated Azure Sentinel SME - L2 to join our team. As an Azure Sentinel SME, you will be responsible for implementing and maintaining security measures in Azure Sentinel. You will work closely with different types of customers to provide guidance on security best practices, and play a crucial role in maintaining a secure and compliant infrastructure.

Responsibilities:
Should have done SIEM Engineering activities. Hands-on experience to configure, manage, and maintain the Microsoft Sentinel SIEM platform including log management, retention configurations, maintenance of logs at low cost. Monitor, analyze, investigate, and respond to security incidents in MS Sentinel by collaborating with the SOC team and customers. Should be able to integrate/onboard devices (Linux, Palo Alto, Fortinet, Windows, and other devices) to Azure Sentinel. Should have expertise in integrating data sources which are not supported by Sentinel tool out-of-the-box. Custom parser development and ability to solve technical issues in Sentinel. Troubleshoot and resolve issues related to SIEM (Sentinel) infrastructure and integrations like logs not reporting to Sentinel. Creation of integration documents and sending them to customers as per requirement. Strong knowledge of different Microsoft Defender products. Generate and review Weekly/Monthly reports to provide insights on security posture and SIEM effectiveness to customers. Regularly review use case performance and keep track of any fine-tuning done to use cases, including identifying scenarios where fine-tuning can be done and effectively communicate to customers/internal for fine-tuning. Act as a single point of contact for the client during any issues of integration or incidents.

Good to Have:
Creation and fine-tuning in Custom KQL queries and functions for complex detection and monitoring. Preference should be given to candidates who have completed expert training and certifications in Sentinel and Defender products of Microsoft.

Requirements:
Knowledge of Workbooks creation. Building Playbooks (Enrichment and Response) in Sentinel automation through Logic Apps.

Important Criteria:
Strong communication, collaboration, and multi-tasking skills to work effectively with cross-functional teams and stakeholders. Relevant professional certifications such as: AZ-900, SC-900, SC-200, Certified Ethical Hacker (CEH), or any other SIEM Engineering certification. Stay updated with the latest trends and developments in SIEM technologies and cybersecurity threats and utilize it in the system if required.