Senior Security Engineer - SIEM/ArcSight

Position Summary :

• Manage, monitor, and optimize global (GSOC) and local SOC environments.

• Protect enterprise data using advanced DLP strategies.

• Detect, analyze, and mitigate cyber threats across endpoints, proxies, and cloud infrastructure using SIEM, EDR, and automation tools.

Key Responsibilities : SOC Operations & Incident Response :

• Triaging alerts : Monitor global and local SOC environments for real-time security events.

• Incident investigation : Execute standard Incident Playbooks to contain and neutralize threats.

• Forensic analysis : Conduct root cause analysis on network and endpoint security incidents.

• Threat hunting : Search logs proactively to identify undetected malicious activities.

SIEM Management & Engineering (ArcSight) :

• Platform administration : Manage and configure ArcSight SIEM Manager.

• Log parsing : Develop and maintain custom ArcSight Parsers for unique log sources.

• Rule optimization : Fine-tune SIEM use cases to reduce false positive alerts.

• Data correlation : Create correlation rules to detect complex attack patterns.

Data Loss Prevention (DLP) Strategy :

• Policy engineering : Design, deploy, and maintain corporate DLP policies across the enterprise.

• Tool management : Configure and manage Symantec DLP tools and technologies.

• Incident mitigation : Monitor, detect, and respond to unauthorized data transfers.

• Access governance : Implement data encryption practices to safeguard sensitive information.

Endpoint & Infrastructure Security :

• EDR management : Deploy and maintain Endpoint Detection and Response (EDR) solutions.

• Vulnerability scanning : Run network and system vulnerability assessments using Nessus.

• Endpoint control : Use Tanium for real-time asset discovery and endpoint management.

• Access controls : Manage secure web gateways (Proxies) and Mobile Device Management (MDM).

Automation & Orchestration :

• Playbook development : Build automated workflows within the SOAR platform.

• Process optimization : Streamline response times by automating repetitive analyst tasks.

• Tool integration : Connect SIEM, EDR, and DLP tools into the SOAR ecosystem.

Required Technical Skills :

• SIEM : ArcSight SIEM Manager, ArcSight Parser development.

• DLP : Symantec DLP Tool, policy creation, data classification.

• Automation : Security Orchestration, Automation, and Response (SOAR) playbooks.

• Vulnerability & Endpoint : Nessus, Tanium, EDR platforms.

• Network & Mobility : Secure Web Proxies, Mobile Device Management (MDM).

• Core Security : Cryptography/Encryption standards, threat hunting methodologies, digital forensics.

Preferred Qualifications :

• Experience working in a hybrid GSOC / Local SOC architecture.

• Industry certifications : CISSP, CEH, GCIH, or platform-specific certifications (ArcSight, Symantec, Tanium).

Work Environment :

• This position may involve working in an office setting or remotely, depending on company policies and flexibility in hours may be required to meet team needs.

Additional Information :

• Shift : General. Five days working!

• Head office & Interview location : Aviva India (HO) 401A, 4th Floor, Dlf Cyber Park, Phase II, Block A, Sector 20, Gurugram, Haryana 122002.