Shuvel Digital
Microsoft Azure Sentinel SIEM Engineer
Shuvel Digital, New York, New York, United States,
Senior Secure Innovation and Resilience (SI&R) Resource - Microsoft Azure Professional who is experienced with Kusto Query Language (KQL) and design of security-specific alerts. The senior resource will work within the current information security team and perform as a lead technical Subject Matter Expert (SME) that will also liaise to the appropriate business units (BU) to support security strategy and ensure accuracy of related data.
Resource will evaluate specific logging, monitoring, and alerting events for efficiency and provide industry best practice recommendation for continuous improvement as Navy Federal Credit Unions application portfolio is moved into a Security Information and Event Management (SIEM) solution. Additionally, the resource will follow Navy Federal Credit Unions established delivery cadence for either agile (methods for sprint planning, sprint refinements, sprint standup, and retrospectives) or traditional waterfall where appropriate.
Resource will provide professional services deeply rooted in Azure Log Analytics with focus on Kusto Query Language (KQL). The resource will collaborate with NFCU's technical and business teams as needed to determine any deficiencies and ensure continuous improvement as well as take part in any related agile or traditional development engagements which ultimately integrate with the team's application portfolio.
The resource shall provide the following analytical, development, and support services:
Evaluate specific application's capability for logging, monitoring, and alerting information in the NFCU environment either on-prem, cloud, or hybrid
Serve as a critical Quality Assurance (QA) point within a four-stage process used to integrate NFCU's application portfolio to Splunk Logging and Alerting
Evaluate the completeness and accuracy of the information provided and verify that the log entries meet criteria provided for monitoring and alerting
Validate the submitted information through use of Microsoft (KQL) and assist with mapping to data in Splunk
Identify deficiencies and revert the workflow as needed to collect additional information when encountering inaccurate or incomplete information
Interact with the appropriate Business Unit (BU) contact and/or technical contact to gain clarity on difficult to obtain, incomplete, or inaccurate information
Activity
Development and Analysis functions to validate existing logs are sufficient to implement monitoring and alerting.
Use Azure Log Analytics to collect and index log data, develop queries, log integration support and reporting
Ingest new data sources to implement use cases, dashboards, and automated reports
Perform Quality Assurance review of new use cases prior to deployment into application portfolio
Ensure standards are maintained
Validate the submitted information through use of KQL
Troubleshoot existing use cases for root cause and provide issue resolution
Assist with identifying and escalating issues and risks developing plans for resolution
Assist with issue and risk prioritization
Deliverables
Azure Log Analytics CSOC use cases and related queries
Associated scripts, etc. for remediation of use cases that failed to execute
Define and assist in the creation of operational and executive security reports and dashboards
Root Cause Analysis of issues
Capture and migration of documentation of use cases, queries, alerts, etc. for storing into ServiceNow Knowledge Management articles or leverage Azure ADO Wiki pages to create knowledge management articles
Conduct 1-1 training and job shadowing for comprehensive knowledge transfer
Critical Skills
Expert-level, hands-on Log Analytics engineer with experience in complex environments
Expert in Kusto Query Language (KQL)
Deep knowledge of other SIEM platforms, such as Splunk, QRadar, or Arcsight
Previous experience in applying knowledge to uncover threats based on log data within Cloud Service Provider (CSP) environments (Azure AAD, Azure Resources, Event logs, etc.) to build, analyze, and tune detections.
Experience with Microsoft Cloud Security Technologies such as Azure Sentinel, Microsoft Defender, MDE, ATP, Azure Data Explorer and Azure Log Analytics or similar products like ArcSight, Splunk and Logstash
Demonstrated ability to understand and communicate technical details with varying levels of management
Resource will evaluate specific logging, monitoring, and alerting events for efficiency and provide industry best practice recommendation for continuous improvement as Navy Federal Credit Unions application portfolio is moved into a Security Information and Event Management (SIEM) solution. Additionally, the resource will follow Navy Federal Credit Unions established delivery cadence for either agile (methods for sprint planning, sprint refinements, sprint standup, and retrospectives) or traditional waterfall where appropriate.
Resource will provide professional services deeply rooted in Azure Log Analytics with focus on Kusto Query Language (KQL). The resource will collaborate with NFCU's technical and business teams as needed to determine any deficiencies and ensure continuous improvement as well as take part in any related agile or traditional development engagements which ultimately integrate with the team's application portfolio.
The resource shall provide the following analytical, development, and support services:
Evaluate specific application's capability for logging, monitoring, and alerting information in the NFCU environment either on-prem, cloud, or hybrid
Serve as a critical Quality Assurance (QA) point within a four-stage process used to integrate NFCU's application portfolio to Splunk Logging and Alerting
Evaluate the completeness and accuracy of the information provided and verify that the log entries meet criteria provided for monitoring and alerting
Validate the submitted information through use of Microsoft (KQL) and assist with mapping to data in Splunk
Identify deficiencies and revert the workflow as needed to collect additional information when encountering inaccurate or incomplete information
Interact with the appropriate Business Unit (BU) contact and/or technical contact to gain clarity on difficult to obtain, incomplete, or inaccurate information
Activity
Development and Analysis functions to validate existing logs are sufficient to implement monitoring and alerting.
Use Azure Log Analytics to collect and index log data, develop queries, log integration support and reporting
Ingest new data sources to implement use cases, dashboards, and automated reports
Perform Quality Assurance review of new use cases prior to deployment into application portfolio
Ensure standards are maintained
Validate the submitted information through use of KQL
Troubleshoot existing use cases for root cause and provide issue resolution
Assist with identifying and escalating issues and risks developing plans for resolution
Assist with issue and risk prioritization
Deliverables
Azure Log Analytics CSOC use cases and related queries
Associated scripts, etc. for remediation of use cases that failed to execute
Define and assist in the creation of operational and executive security reports and dashboards
Root Cause Analysis of issues
Capture and migration of documentation of use cases, queries, alerts, etc. for storing into ServiceNow Knowledge Management articles or leverage Azure ADO Wiki pages to create knowledge management articles
Conduct 1-1 training and job shadowing for comprehensive knowledge transfer
Critical Skills
Expert-level, hands-on Log Analytics engineer with experience in complex environments
Expert in Kusto Query Language (KQL)
Deep knowledge of other SIEM platforms, such as Splunk, QRadar, or Arcsight
Previous experience in applying knowledge to uncover threats based on log data within Cloud Service Provider (CSP) environments (Azure AAD, Azure Resources, Event logs, etc.) to build, analyze, and tune detections.
Experience with Microsoft Cloud Security Technologies such as Azure Sentinel, Microsoft Defender, MDE, ATP, Azure Data Explorer and Azure Log Analytics or similar products like ArcSight, Splunk and Logstash
Demonstrated ability to understand and communicate technical details with varying levels of management