SIEM Analyst - CrowdStrike Falcon

MUST HAVE:

• Crowdstrike Falcon

Must-Have Requirements:

·      Knowledge and experience in CrowdStrike Falcon Next-Gen SIEM, ONUM, Splunk ES SIEM in Security Incident Event Management processes, Log source onboarding, Logging and Monitoring requirements

·      Knowledge and experience in a SIEM environment with common IT and Security Tools: CrowdStrike Falcon, ONUM, CRIBL, Firewalls, Proxy, DNS, VPN, Active Directory, Windows, Linux, etc.

·      Familiar with Jira, ServiceNow CMDB and Confluence.

·      Experience or familiarity with implementing and configuring log sources to report to SIEM and Centralized Logging and Monitoring Solutions including Splunk, CRIBL and Syslog-NG or equivalent products.

·      Familiarity with the National Institute of Standards and Technology (NIST) Cyber Security Framework and Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool (CAT).

Description:

The SIEM Analyst will be responsible for supporting the Cyber Detect foundational capabilities that include Centralized Logging and Monitoring using CrowdStrike Falcon Next-Gen SIEM, ONUM and supporting the migration from Splunk Cloud, CRIBL, Syslog-NG and related products to CrowdStrike Falcon Next-Gen SIEM. Support US SIEM Operation and migration of log sources to CrowdStrike Falcon Next-Gen SIEM ensuring proper coverage by validation that log data is complete using multiple criteria (volume, type of events and enriched fields).

Responsibilities:

·      Support and enable data bifurcation from existing SIEM environment to the new CrowdStrike Falcon Next-Gen SIEM to allow migration.

·      Coordinate implementation of requirements to allow data bifurcation to CrowdStrike Falcon Next-Gen SIEM.

·      Coordinate validation of Internet/GSNet bandwidth requirements and Proxy capacity to support log data bifurcation form Ingestion layer to CrowdStrike Falcon Next-Gen SIEM.

·      Monitor for potential log outages and maintain log sources reporting to the SIEM.

·      Validate that required log data for US unique requirements are migrated properly. FRB Apps including SOX/GLBA, DB logs, Badge logs, PingFed, IBM API connect, etc.

·      Perform log source data analysis to confirm parsing rules are working as expected. Validating required fields and ensure applicable CIM (Common Information Model) compliance.