Responsibilities:

• Lead the technical implementation, configuration, and troubleshooting of various cybersecurity solutions, including SIEM, EDR/XDR, DLP, NDR, NAC, and related technologies.
• Subject Matter Expert in LogRhythm SIEM fine-tuning, administration, and troubleshooting.
• Rules, Alerts, Dashboards, and Reports creation according to business and operational requirements
• Developing and Building Security Use Cases according to the MITRE Attack framework.
• Performing gap assessments on the SIEM log sources and use cases.
• Creating playbooks to provide step-by-step guidance and structure processes for resolving SIEM alerts.
• Creating an auditing framework for Linux & Windows, describing what logs should be ingested to maximize SIEM’s detection capabilities.
• Creating and developing SIEM health check reports for LogRhythm & Qradar SIEM solutions.
• Integrate & onboard new log sources such as API, syslog, UDLA, Windows, Flat Files & Database.
• Experience with LogRhythm MPE rule builder to optimize and build new rules using regex.
• Provide technical support and troubleshooting for deployed security solutions.
• Collaborate with the security team to enhance the organization’s overall security posture.

Qualifications:

• Bachelor’s degree in computer science, Information Security, Cybersecurity, or a related field (preferred).
• Minimum 2 years of experience in threat detection and SOC environments.
• Strong hands-on experience with LogRhythm SIEM platform, and EDR/XDR/NDR/DLP technologies.
• Solid experience in MITRE ATT&CK framework and detection engineering methodologies.
• Familiarity with compliance standards such as ISO 27001, NIST, NCA ECC, and GDPR.
• Strong analytical skills and the ability to translate threat intelligence into actionable detections.
• Strong willingness to learn and grow within the cybersecurity field.

Key Skills

• Detection Engineering
• Threat Hunting
• MITRE ATT&CK Framework
• SIEM & EDR Tools (e.g., QRadar, Sentinel, Splunk, CarbonBlack, Netwitness)
• Log Analysis and Correlation
• Incident Response
• Basic understanding of scripting languages used for cybersecurity (Python, PowerShell, etc.)
• Familiarity with Sigma and Yara rules