SIEM Administrator Join BARQ Systems to manage, maintain, and optimize our SIEM platform and data pipelines. Key Responsibilities: Administer SIEM infrastructure and data ingestion. Onboard sources (Firewalls, EDR, WAF, DLP, Proxy). Handle upgrades, patches, storage, and access controls. Support detection tuning, dashboards, and troubleshooting. Requirements: 2+ yrs SIEM experience; strong Linux skills required; Splunk preferred; off-hours flexibility.
Experience: Minimum 2 years of relevant SIEM administration experience.
Job Responsibilities:
Administer, maintain, and monitor the SIEM platform and ensure its availability and performance.
Manage SIEM infrastructure, including indexers, search heads, deployment servers, forwarders, and related components.
Onboard and integrate security data sources such as firewalls, EDR, WAF, proxy, DLP apps , …etc.
Configure and troubleshoot Universal Forwarders, Heavy Forwarders, and data ingestion pipelines.
Develop and maintain data inputs, sourcetypes, parsing, field extractions, and data models.
Monitor log ingestion, identify data gaps, and troubleshoot ingestion and parsing issues.
Manage SIEM upgrades, patches, version compatibility, and configuration changes.
Support the implementation, tuning, and troubleshooting of correlation searches, detection rules, alerts, and dashboards.
Monitor SIEM performance, storage, indexing, search performance, and license utilization.
Implement and maintain appropriate access controls, roles, authentication, and security configurations.
Support backup, retention, disaster recovery, and SIEM high-availability requirements.
Troubleshoot SIEM-related incidents and coordinate with vendors and other teams when required.
Maintain technical documentation for SIEM architecture, integrations, configurations, and operational procedures.
Required Skills:
Minimum 2 years of hands-on SIEM administration experience.
Strong Linux administration and troubleshooting skills – mandatory.
Hands-on experience with Splunk administration is highly preferred.
Good understanding of TCP/IP, DNS, HTTP/HTTPS, Syslog, and network security concepts.
Experience integrating security and infrastructure technologies with SIEM platforms.
Understanding of SIEM architecture, log management, parsing, normalization, and retention.
Strong troubleshooting, analytical, and problem-solving skills.
Ability to work closely with SOC analysts, security teams, infrastructure teams, and vendors.
Good command of English is required, as the role involves regular communication and coordination with vendors.
flexibility to work outside regular working hours, including weekends, when required.
Fill out the form and upload your CV to submit your application.