SIEM/SOAR Production Services Specialist ll

Job Overview Bank of America’s IT Security team seeks an experienced professional to manage and optimize Splunk and other SIEM/SOAR platforms, develop detection rules, automation playbooks, and dashboards, and provide advanced threat detection and incident response in a fast‑paced FinTech environment. Key Responsibilities Lead production support triage efforts, manage bridge line troubleshooting, perform technical research, and escalates issues to leadership as needed. Ensure all impacts are accurately recorded, documented, and that wikis and documents are updated for use during triage. Support documentation of application flows, upstream/downstream impacts during outages, the customer experience, and contacts for support needs. Identify and validate business impacts through monitors, dashboards, and logs to communicate with leadership and vendors. Manage activities to identify incident root cause, resolution, preventative actions, change requests, and report on incident data quality. Promote and enforce production governance during triage/testing, identify production failure scenarios, vulnerabilities, and opportunities for improvement. Serve as a subject matter expert for applications within a portfolio, leveraging extensive knowledge of application functionalities and flows. Assess and prioritize research requests, ad hoc reports, and offline incidents at the direction of senior team members, delegating work as needed to team members and peers. Required Qualifications 5+ years of experience in SIEM/SOAR administration and security operations. Strong hands‑on knowledge of Splunk (searches, dashboards, alerts, playbooks) and security frameworks, threat detection, and incident response. Over 10 years of experience in IAM (identity and access management) within regulated FinTech, with expert knowledge of MFA technologies. Expertise in Windows OS, RedHat Linux, SQL/Oracle, Unix/Linux, and scripting (PowerShell, Unix). Experience with RedHat Linux OpenShift containers, Atlassian JIRA & Horizon platforms, GitHub, Ansible, Jenkins, ITSM Remedy, Splunk, Dynatrace, and cloud CI/CD DevOps tools. Must comply with bank regulatory and compliance policies, and be willing to work on‑call Saturdays/Sundays, off hours, and on‑site three days a week. Strong understanding of the 5 C’s of cyber security (Change, Compliance, Cost, Continuity, Coverage). Excellent communication skills, teamwork, and the ability to work under pressure and stress. Familiarity with ITIL framework and proven production support experience in SIEM/SOAR and IAM technologies. Desired Qualifications CISSP or other equivalent information security certification. Strong motivation, drive for results, and the ability to persist in the face of significant difficulties. Experience with Tower, BladeLogic, and strong understanding of network technologies. Adaptability, analytical thinking, influence, production support risk management, automation, collaboration, innovative thinking, solution design, business acumen, DevOps practices, project management, solution delivery, stakeholder management. Schedule Shift: 1st shift (United States of America). Hours per week: 40. On‑call coverage required Saturdays or Sundays, and availability to work off hours as needed. On‑site attendance 3 days a week per current bank policies. #J-18808-Ljbffr Bank of America