Chronicle/Azure Sentinel SIEM Developer

Job Title: Chronicle/Azure Sentinel SIEM Developer

Position Overview:

We are looking for a skilled SIEM Engineer with 5-8 years of experience specializing in SIEM technologies such as Google SecOps/Chronicle, and Azure Sentinel. The ideal candidate will have hands-on expertise in building advanced detection use cases, developing dashboards, and implementing SOAR workflows to enhance cyber threat detection and response capabilities.

Key Responsibilities:

• Design and implement use cases based on NIST and MITRE ATT&CK frameworks to detect cyber threats at various stages.
• Develop complex correlation rules using SPL (Splunk Processing Language) and KQL (Kusto Query Language).
• Build and maintain dashboards, alerts, and workbooks for effective monitoring and incident detection.
• Implement and manage SOAR workflows using platforms like Logic Apps, Phantom, and Demisto.
• Assist in the administration, optimization, and maintenance of Splunk Enterprise and Splunk ES environments.
• Integrate log sources with Azure Sentinel using REST APIs.
• Support clustered SIEM environments with focus on high availability and parallel processing.
• Work with Azure security services such as Azure Security Center, Azure Monitor, Log Analytics, NSG, Azure Functions, and Defender ATP.
• Participate in threat intelligence gathering and threat hunting activities.

Preferred Knowledge & Skills:

• Strong understanding of SIEM architecture and components.
• Basic knowledge of User Entity Behavior Analytics (UEBA) and machine learning models.
• Proficiency in scripting with Python is a plus.
• Familiarity with cloud and hybrid environments, particularly Azure cloud services.
• Experience working in clustered environments focusing on scalability and fault tolerance.
• Knowledge of cybersecurity frameworks (NIST, MITRE ATT&CK) and threat intelligence concepts.

Required Qualifications:

• 5-8 years of hands-on experience with SIEM solutions, including Google SecOps/Chronicle, and Azure Sentinel.
• Strong expertise in SPL/KQL query languages.
• Experience implementing SOAR workflows and automations.
• Bachelors degree in Computer Science, Information Security, or related field preferred.

o XSOAR, Proofpoint, O365