Capgemini Government Solutions
Principal SIEM Engineer (ArcSight & Splunk)
Capgemini Government Solutions, Washington, District of Columbia, us, 20022
Capgemini Government Solutions (CGS) LLC seeks a highly motivated SIEM engineer with experience managing both ArcSight and Splunk. The ArcSight/Splunk Engineer will be responsible for configuring the collection, parsing, correlation, and visualization of events for a critical operational system. Ability to demonstrate strong skills in system administration, log management, event correlation, and threat detection and will support building and maintaining a system that analyzes collected data and derives facts, inferences, and projections to determine if the systems being monitored are operating normally. The individual will lead efforts for configuring the systems which support analysts and end-users. The successful candidate will support the collection and extraction of data used to refine existing and new reports, analytics, and dashboards, and will be involved with the drafting and creation of reports and dashboards based on end-user requirements. She/he will also support the integration of resources across teams to better define the audit data being collected to eliminate false positives and false negatives from the data.
As a Principal SIEM Engineer (ArcSight & Splunk), you will be:
Responsible for design, implementation and support of ArcSight or Splunk core components, including ESM, Loggers, Smart Connectors, Indexers, Forwarders, Search Heads, and Cluster Managers. Responsible for configuration and administration of ArcSight or Splunk ingestion and forwarding for new and existing applications and data. Responsible for troubleshooting ArcSight or Splunk dataflow issues between the various event flow components. Responsible for configuring and deploying data collection for a variety of operating systems and networking platforms. Responsible for creating Dashboards and Analytics within SIEM tools. Working with monitoring systems supporting auditing, incident response, and system health. Responsible for understanding of networking components and devices, ports, protocols, and basic networking troubleshooting steps.
Required Qualifications:
US citizenship is required. Ability to obtain TS/SCI clearance. Bachelor's degree in information technology, Computer Science, Information Systems, or related field. A minimum of 8 years of related cybersecurity experience. A minimum of at least 4 years of experience with either ArcSight or Splunk. Experience in design, implementation, and support of ArcSight or Splunk core components, including: ESM, Loggers, Smart Connectors, Indexers, Forwarders, Search Heads, and Cluster Managers. Experience with configuration and administration of ArcSight or Splunk ingestion and forwarding for new and existing applications and data. Experience with troubleshooting ArcSight or Splunk dataflow issues between the various event flow components. Experience configuring and deploying data collection for a variety of operating systems and networking platforms. Experience creating Dashboards and Analytics within SIEM tools. Experience working with monitoring systems supporting auditing, incident response, and system health. Understanding of networking components and devices, ports, protocols, and basic networking troubleshooting steps. The ability to troubleshoot issues with log feeds, search time, and field extractions. The ability to troubleshoot problems related to data solutions.
Desired Skills:
Network Security Operations Center (SOC) experience. Experience and talent in data correlation. Experience creating workflows for Incident Response within a SIEM Tool. GIAC Certified Incident Handler Certification. GIAC Cyber Threat Intelligence Certification. Cybersecurity certifications. Formal SIEM training.
Life at Capgemini
Capgemini supports all aspects of your well-being throughout the changing stages of your life and career. For eligible employees, we offer:
Flexible work. Healthcare including dental, vision, mental health, and well-being programs. Financial well-being programs such as 401(k) and Employee Share Ownership Plan. Paid time off and paid holidays. Paid parental leave. Family building benefits like adoption assistance, surrogacy, and cryopreservation. Social well-being benefits like subsidized back-up child/elder care and tutoring. Mentoring, coaching and learning programs. Employee Resource Groups. Disaster Relief.
About Capgemini
Capgemini is a global leader in partnering with companies to transform and manage their business by harnessing the power of technology. The Group is guided every day by its purpose of unleashing human energy through technology for an inclusive and sustainable future. It is a responsible and diverse organization of over 360,000 team members in more than 50 countries. With its strong 55-year heritage and deep industry expertise, Capgemini is trusted by its clients to address the entire breadth of their business needs, from strategy and design to operations, fueled by the fast-evolving and innovative world of cloud, data, AI, connectivity, software, digital engineering and platforms. The Group reported in 2022 global revenues of 22 billion.
Get The Future You Want | www.capgemini.com
Disclaimer
Capgemini is an Equal Opportunity Employer encouraging diversity in the workplace. All qualified applicants will receive consideration for employment without regard to race, national origin, gender identity/expression, age, religion, disability, sexual orientation, genetics, veteran status, marital status or any other characteristic protected by law.
#J-18808-Ljbffr
As a Principal SIEM Engineer (ArcSight & Splunk), you will be:
Responsible for design, implementation and support of ArcSight or Splunk core components, including ESM, Loggers, Smart Connectors, Indexers, Forwarders, Search Heads, and Cluster Managers. Responsible for configuration and administration of ArcSight or Splunk ingestion and forwarding for new and existing applications and data. Responsible for troubleshooting ArcSight or Splunk dataflow issues between the various event flow components. Responsible for configuring and deploying data collection for a variety of operating systems and networking platforms. Responsible for creating Dashboards and Analytics within SIEM tools. Working with monitoring systems supporting auditing, incident response, and system health. Responsible for understanding of networking components and devices, ports, protocols, and basic networking troubleshooting steps.
Required Qualifications:
US citizenship is required. Ability to obtain TS/SCI clearance. Bachelor's degree in information technology, Computer Science, Information Systems, or related field. A minimum of 8 years of related cybersecurity experience. A minimum of at least 4 years of experience with either ArcSight or Splunk. Experience in design, implementation, and support of ArcSight or Splunk core components, including: ESM, Loggers, Smart Connectors, Indexers, Forwarders, Search Heads, and Cluster Managers. Experience with configuration and administration of ArcSight or Splunk ingestion and forwarding for new and existing applications and data. Experience with troubleshooting ArcSight or Splunk dataflow issues between the various event flow components. Experience configuring and deploying data collection for a variety of operating systems and networking platforms. Experience creating Dashboards and Analytics within SIEM tools. Experience working with monitoring systems supporting auditing, incident response, and system health. Understanding of networking components and devices, ports, protocols, and basic networking troubleshooting steps. The ability to troubleshoot issues with log feeds, search time, and field extractions. The ability to troubleshoot problems related to data solutions.
Desired Skills:
Network Security Operations Center (SOC) experience. Experience and talent in data correlation. Experience creating workflows for Incident Response within a SIEM Tool. GIAC Certified Incident Handler Certification. GIAC Cyber Threat Intelligence Certification. Cybersecurity certifications. Formal SIEM training.
Life at Capgemini
Capgemini supports all aspects of your well-being throughout the changing stages of your life and career. For eligible employees, we offer:
Flexible work. Healthcare including dental, vision, mental health, and well-being programs. Financial well-being programs such as 401(k) and Employee Share Ownership Plan. Paid time off and paid holidays. Paid parental leave. Family building benefits like adoption assistance, surrogacy, and cryopreservation. Social well-being benefits like subsidized back-up child/elder care and tutoring. Mentoring, coaching and learning programs. Employee Resource Groups. Disaster Relief.
About Capgemini
Capgemini is a global leader in partnering with companies to transform and manage their business by harnessing the power of technology. The Group is guided every day by its purpose of unleashing human energy through technology for an inclusive and sustainable future. It is a responsible and diverse organization of over 360,000 team members in more than 50 countries. With its strong 55-year heritage and deep industry expertise, Capgemini is trusted by its clients to address the entire breadth of their business needs, from strategy and design to operations, fueled by the fast-evolving and innovative world of cloud, data, AI, connectivity, software, digital engineering and platforms. The Group reported in 2022 global revenues of 22 billion.
Get The Future You Want | www.capgemini.com
Disclaimer
Capgemini is an Equal Opportunity Employer encouraging diversity in the workplace. All qualified applicants will receive consideration for employment without regard to race, national origin, gender identity/expression, age, religion, disability, sexual orientation, genetics, veteran status, marital status or any other characteristic protected by law.
#J-18808-Ljbffr