Splunk / Siem

Job Overview

Emdad Excellence, a dynamic and forward-thinking subsidiary of Emdad Group headquartered in Riyadh, Saudi Arabia, is seeking a highly skilled and experienced Splunk/SIEM professional to join our team. As a critical member of our workforce solutions division, you will play a pivotal role in ensuring the security, efficiency, and compliance of our enterprise environments. Your expertise will be instrumental in managing, optimizing, and enhancing our Splunk Enterprise and SIEM solutions to meet the evolving demands of modern business operations in the Kingdom.

Key Responsibilities

• Splunk Enterprise Administration: Oversee the full lifecycle of the Splunk Enterprise environment, including deployment, user management, license administration, upgrades, patch deployments, and configuration management. Ensure seamless addition or removal of log sources, change management, and robust backup and recovery processes.
• Log Source Onboarding and Management: Lead the onboarding of new log sources, ensuring they are properly integrated and configured to transmit logs efficiently to the Splunk platform. Troubleshoot and resolve any issues related to log source connectivity or data ingestion.
• SIEM Content Development: Design, develop, and implement security use cases using Splunk Enterprise Security. Construct comprehensive SIEM content, including correlation rules, reports, report templates, and advanced queries, to enhance threat detection and response capabilities.
• Support and Incident Management: Manage support tickets related to SIEM operations, collaborating with internal and external stakeholders to resolve issues promptly. Maintain a proactive approach to monitoring and troubleshooting to minimize disruptions.
• Continuous Improvement: Regularly review and evaluate existing Splunk configurations to identify opportunities for enhancement. Develop and refine use cases, dashboards, alerts, and reports to align with evolving business requirements and security best practices.
• Custom Correlation Rules: Create and implement custom correlation rules tailored to specific devices and business needs, ensuring robust threat detection and incident response.
• Regulatory Compliance Support: Assist in audits conducted by regulatory bodies in the Kingdom by providing accurate and timely evidence from the SIEM solution. Ensure adherence to local and international compliance standards.
• Log Parsing and Threat Intelligence: Develop parsing rules for non-standard logs to ensure accurate data ingestion and analysis. Configure threat feeds, IoCs (Indicators of Compromise), Sigma rules, and advisories from regulatory bodies and globally recognized organizations to bolster threat detection capabilities.
• Splunk UBA Administration: Manage the Splunk User Behavior Analytics (UBA) environment, including data ingestion of CIM-compliant data, raw events, and HR data from the Splunk Platform. Monitor UBA health using the Splunk UBA Monitoring App and perform regular backups and failover procedures to ensure high availability and data integrity.

Qualifications and Experience

To excel in this role, candidates must possess a minimum of five years of hands-on experience in Splunk Enterprise and SIEM environments. Proficiency in Splunk Enterprise Security, UBA, log source management, and correlation rule development is essential. Strong analytical skills, attention to detail, and the ability to work in a fast-paced, collaborative environment are critical. Familiarity with regulatory compliance frameworks and experience supporting audits will be highly advantageous.

Why Join Emdad Excellence?

As a member of Emdad Excellence, you will be part of a dynamic organization committed to empowering workforce success through innovative and compliant solutions. You will have the opportunity to work with cutting-edge technologies, collaborate with industry experts, and contribute to the growth and success of a leading enterprise in Saudi Arabia. We offer a competitive compensation package, professional development opportunities, and a supportive work environment that fosters innovation and excellence.