Senior Cybersecurity Specialist (Splunk Architect)

Senior Cybersecurity Specialist (Splunk Architect)

Help AG is seeking a seasoned Senior Cybersecurity Specialist (Splunk Architect) to drive the creation, implementation, and upkeep of security systems across our internal and client environments. This role involves collaborating with management, security teams, solution architects, and clients to deliver high-impact services to our Managed Security Service clients.

The Senior Cybersecurity Specialist (Splunk Architect) will be based in Riyadh, KSA, under the Cyber Engineering department. Key responsibilities include:

• Administering and maintaining Splunk and Splunk Apps, developing new or extending existing Apps for specialized functionality.
• Integrating Splunk with diverse legacy data sources.
• Learning and integrating new SOC technologies from various vendors.
• Establishing best practices for utilizing Splunk data and visualizations with application and infrastructure teams.
• Designing, implementing, and supporting solutions with Microsoft security technologies, such as Azure Cloud Access Security Broker, Office 365 Advanced Threat Protection, and Microsoft Defender ATP.
• Managing EDR sensors, including deployment, operation, and maintenance.
• Creating watchlists to detect Indicators of Compromise (IoCs) and malicious behavior.
• Assessing customer needs, designing solutions, and implementing them.
• Serving as a primary responder for client systems, taking ownership of configuration issues and tracking them to resolution.
• Proactively enhancing service quality and fine-tuning false positives.
• Developing content for SOC technologies in cooperation with the SOC team.

Candidates should possess:

• Proven experience (3+ years) supporting and maintaining Splunk SIEM & Enterprise Security.
• Experience (3-5 years) in advanced tuning of Splunk SIEM content.
• Professional experience working with networks and network architecture.
• Bachelor’s degree or equivalent training with experience in a Security Operations Center, Managed Security, or client network environment.
• Practical hands-on experience in EDR, Vectra, and Microsoft Azure.
• General security knowledge and relevant Splunk certifications.
• Knowledge of Linux and Windows Operating Systems.
• Experience with other SIEM solutions (e.g., QRadar & LogRhythm) is a plus.
• Experience working with clients in a service delivery function.
• Shift flexibility for after-hours support.
• Experience working with internal and client ticketing systems.

We offer:

• Health insurance with a leading global provider.
• Career progression through challenging projects.
• Employee engagement activities throughout the year.
• Tailored training and development opportunities.