SIEM/SOAR Production Services Specialist ll

Job Description The role is responsible for providing front‑line support to end users, responding to incidents and problem management governance, and leading triage activities for all business‑impacting incidents. The position ensures compliance with incident management and problem management policies, serves as the focal point for the customer and associate experience, restores complex production incidents under tight Service Level Agreements, and pursues root‑cause analysis and problem‑resolution follow‑ups. Responsibilities Leads production support triage efforts, manages bridge line troubleshooting, engages in technical research, and escalates issues to leadership as needed. Ensures all impacts are accurately recorded and documented in the system of record, oversees that documents and wikis are updated and available for use during triage, and supports the documentation of application flows, upstream/downstream impacts during outages, the customer experience, and contacts for support needs. Identifies and/or validates business impacts through interpretation of monitors, dashboards, and logs to communicate with leadership and vendors. Manages activities to identify incident root cause, resolution, preventative actions, and change requests, and reports on incident data quality. Promotes and enforces production governance during triage/testing and identifies production failure scenarios, vulnerabilities, and opportunities for improvement. Serves as a subject matter expert for applications within a portfolio, leveraging extensive knowledge of application functionalities and application flows. Assesses and prioritizes research requests, ad hoc reports, and offline incidents at the direction of senior team members and delegates work as needed to team members and peers. Manages and optimizes SIEM/SOAR platforms (primarily Splunk) for advanced threat detection, automation, and incident response. Collaborates with IT teams to build detection rules, automation playbooks, and dashboards that strengthen security posture in a fast‑paced FinTech environment. Develops detection rules, dashboards, and automation playbooks. Monitors and analyzes security events to identify threats and reduce response times. Delivers services to internal customers to facilitate business continuity with meet or exceed SLAs, including monitoring, incident response, problem engagement during triage, service restoral, root‑cause identification, and facilitation of permanent fixes. Position Summary 5+ years of hands‑on expertise in SIEM/SOAR, primarily Splunk, in a highly regulated FinTech environment. The candidate will manage, configure, and optimize SIEM/SOAR platforms, develop detection rules and automation playbooks, and work closely with IT teams to strengthen the organization’s security posture. Required Qualifications MUST BE ABLE TO WORK SATURDAY OR SUNDAY WHEN ON CALL OR FOR NEW RELEASES 5+ years of experience in SIEM/SOAR administration and security operations . Well conversant with 5 C's of cyber security – Change, Compliance, Cost, Continuity and Coverage. Passionate about cybersecurity and automation, a SIEM/SOAR expert to help strengthen cyber resilience. Use Splunk skills to fight threats and keep financial services secure. Strong hands‑on knowledge of Splunk (searches, dashboards, alerts, playbooks) . Solid understanding of cybersecurity frameworks, threat detection, and incident response. 5+ years of production support experience with expert level knowledge of MFA technologies, Splunk, Windows OS, SQL/Oracle DB & Unix/Linux. Excellent knowledge of Identity, Authentication and Access Management (IAM) domain including SRE and DevOps space. Must have senior level production support experience and troubleshooting skills in SIEM/SOAR space, Splunk and IAM technologies. Must comply with bank regulatory and compliance policies. Must have expert level of Linux experience and be well versed in Splunk queries. Well‑versed with ITIL framework. Excellent communication skills, lateral and vertical, clearly explaining issues, impact and solutions. Great team player, able to collaborate with other team members within or outside the group. Must be available for on‑call coverage and willing to work off hours as and when needed. Must be willing to work on‑site 3 days a week as per current bank policies. Demonstrates strong work ethic and takes pride in accomplishment. Capable of working under pressure and stress. Attention to detail – evaluates smallest details. Problem‑solving – addresses complex challenges creatively. Desired Qualifications CISSP or other equivalent Information Security domain certificates are added value. Cybersecurity professional to safeguard systems in the fast‑moving FinTech world. Go‑getter exhibiting strong motivation and drive for results and success. Persistently overcome significant difficulties, does not give up easily. Experience with Tower, BladeLogic. Strong understanding of network technologies. Key Skills Adaptability Analytical Thinking Influence Production Support Risk Management Automation Collaboration Innovative Thinking Result Orientation Solution Design Business Acumen DevOps Practices Project Management Solution Delivery Process Stakeholder Management Work Details Shift: 1st shift (United States of America) Hours per week: 40 Location: US – IL – Chicago – 540 W Madison St – Bank Of America Plaza (IL4540) Compensation Pay range: $73,600.00 – $143,800.00 annualized salary, offers determined based on experience, education and skill set. Discretionary incentive: eligible for an annual discretionary award based on overall performance and contributions of the line of business. Benefits Industry‑leading benefits, access to paid time off, resources and support to help employees make a genuine impact and contribute to sustainable growth. #J-18808-Ljbffr Koitecc Solutions