SIEM Data Onboarding Engineer

CONTEXT

Imagine a vast digital fortress, constantly under siege. To protect it, a central intelligence hub is needed to gather every whisper, every movement from its furthest reaches. Our client, a major player in its sector, operates at a scale where understanding the digital heartbeat of its entire ecosystem is paramount. They rely on a sophisticated SIEM platform, powered by Splunk, to act as this central brain, processing colossal volumes of security data. However, as their digital footprint expands and new technologies are adopted, countless new sources of critical data emerge daily – from cloud environments and IoT devices to specialized applications. Each new source represents both an opportunity to enhance visibility and a potential blind spot if not properly integrated. This role isn't just about technical integration; it's about extending the eyes and ears of the cybersecurity team, ensuring no threat goes unnoticed and no critical insight is missed. You will be the architect connecting these disparate data streams, transforming raw information into actionable intelligence that defends the enterprise.

ACTIVITIES

• Design, develop, and implement scalable data ingestion pipelines for new security data sources into the Splunk SIEM platform.
• Collaborate with various IT teams (network, infrastructure, application owners) to identify, onboard, and validate new data sources.
• Configure data collection mechanisms (e.g., agents, API integrations, syslog) and ensure secure and efficient data transfer.
• Perform meticulous parsing, normalization, and enrichment of raw log data to ensure consistency and usability within Splunk.
• Develop and maintain Common Information Model (CIM) compliant data models to enhance search capabilities and correlation rules.
• Utilize tools like Cribl to optimize telemetry data flows, ensuring efficiency, filtering, and routing before ingestion.
• Create and maintain comprehensive documentation for all onboarded data sources, pipelines, and configurations.
• Troubleshoot and resolve data ingestion issues, ensuring data integrity and availability for security operations.
• Work closely with security analysts to understand their monitoring requirements and translate them into effective data onboarding strategies.
• Participate in capacity planning and performance tuning of the SIEM data ingestion infrastructure.

EXPECTED ACHIEVEMENTS

• Successful integration of a high volume of diverse data sources into the Splunk SIEM, significantly expanding the organization's security visibility.
• Establishment of robust, efficient, and well-documented data ingestion pipelines that adhere to best practices and security standards.
• Measurable improvement in the quality, consistency, and availability of security data, directly enabling more effective threat detection and incident response.
• Optimized data flow and reduced data volume through intelligent use of tools like Cribl, leading to cost savings and improved SIEM performance.
• Become a trusted expert and go-to person for all data onboarding challenges, actively contributing to the overall maturity of the security operations center.

ENVIRONMENT

Splunk Enterprise/Cloud, Cribl Stream, various data sources (OS logs, network devices, cloud platforms, applications), Python/Shell scripting, Regular Expressions, JSON, XML, REST APIs, Linux/Windows operating systems, Agile methodologies, JIRA, Confluence.