Apply on Employer Site

State of South Carolina · 1 day ago

SIEM Administrator

Columbia, SC

Full-time

Onsite

Mid, Senior Level

4+ years exp

The South Carolina Law Enforcement Division (SLED) is a premier statewide law enforcement agency dedicated to serving and protecting the citizens of South Carolina. They are seeking a SIEM Administrator responsible for designing and implementing best practices within the organization's SIEM, ensuring log ingestion, and providing support to enhance the security posture of the agency.

Government

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Manage the organization's SIEM solution according to industry best practices to ensure the organization is postured to identify and counter emerging cyber threats

Conduct log ingestion monitoring to ensure contact log ingestion of critical log sources. Normalize and parse new log sources for ingestion, and ensure proper log forwarding, parsing, and enrichment of logs

Monitor log retention to meet regulatory requirements and ensure SOC has access to enough logs and data to respond to incidents. Supervise the storage capacity, indexing performance, and search head/cluster health to ensure availability

Create and maintain automation workflows within the SIEM utilizing SOAR integration to increase efficiency and provide the SOC with additional capabilities and enrichment of alert data

Assist the detection engineer and SOC in tuning rules to reduce false positives while maintaining detection efficacy and provide support in threat hunting initiatives with custom searches and analytics

Provide SC CIC agencies with subject matter expertise in SIEM management and additional support to increase their security posture and prepare them to handle security incidents

Qualification

SIEM managementLog ingestionLog parsingCybersecurity conceptsAutomation workflowsWindows log sourcesCommunication skillsLeadership ability

Required

Bachelor's degree in a related field or at least four (4) years of relevant work experience in the areas of information technology, information security, and risk management

Must have good written and verbal communication skills

Must have the ability to lead mid level position in Information Security

Must have a strong foundational knowledge in cybersecurity concepts and operations

Must have a comprehensive understanding of Windows and third party application log sources, log ingestion, and log parsing

This position is in-person based in Columbia, South Carolina

Position is expected to be available on-call 24/7

Statewide travel, including some overnight travel, will be required