Sr Information Security Engineer

Cyber Detect Support Role

The role will be responsible for supporting the Cyber Detect foundational capabilities that include Centralized Logging and Monitoring using CrowdStrike Falcon Next-Gen SIEM, ONUM and supporting the migration from Splunk Cloud, CRIBL, Syslog-NG and related products to CrowdStrike Falcon Next-Gen SIEM.

Duties and Responsibilities:

• Support US SIEM Operation and migration of log sources to CrowdStrike Falcon Next-Gen SIEM ensuring proper coverage by validation that log data is complete using multiple criteria (volume, type of events and enriched fields).
• Support and enable data bifurcation from existing SIEM environment to the new CrowdStrike Falcon Next-Gen SIEM to allow migration.
• Coordinate implementation of requirements to allow data bifurcation to CrowdStrike Falcon Next-Gen SIEM.
• Coordinate validation of Internet/GSNet bandwidth requirements and Proxy capacity to support log data bifurcation form Ingestion layer to CrowdStrike Falcon Next-Gen SIEM.
• Monitor for potential log outages and maintain log sources reporting to the SIEM.
• Validate that required log data for US unique requirements are migrated properly. FRB Apps including SOX/GLBA, DB logs, Badge logs, PingFed, IBM API connect, etc.
• Perform log source data analysis to confirm parsing rules are working as expected. Validating required fields and ensure applicable CIM (Common Information Model) compliance.
• Implement requirements on source hosts to configure necessary components to forward logs to CrowdStrike Falcon Next-Gen SIEM as required by Global standard. This includes Logical Servers and any other sources that require new clients or agents such as CrowdStrike/ONUM/etc.
• Request, coordinate and implement FW rules, network routing and DNS resolution to support Migration to CrowdStrike Falcon Next-Gen SIEM.
• Validate US profiles and permissions are migrate as expected to CrowdStrike Falcon Next-Gen SIEM.
• Document, maintain and improve SIEM Log Source onboarding process for relevant sources including Cloud and SaaS applications.
• Review and provide system configuration and log onboarding requirements to system owners. Update documentation as required.
• Collaborate with other Cyber Security Operations teams to document and implement logging and monitoring capabilities to meet established requirements including Virginia Log Ingestion Layer for scalability with Load Balancer and Proxy support.
• Maintain and update dashboards, reports, log source coverage metrics, and other relevant criteria.
• Participate in the development of monitoring Use Cases as required to enhance the logging and monitoring function.
• Research, analyze and understand log sources utilized for the purpose of security monitoring, particularly security and networking devices.