The posting
Rackspace Security (Public Cloud)
SIEM Engineer L3 (Sentinel + Elastic)
About Rackspace Cyber Defence
Rackspace Cyber Defence is our next generation cyber defence and security operations capability that builds on 20+ years of securing customer environments to deliver proactive, risk-based, threat-informed and intelligence driven security services.
Our purpose is to enable our customers to defend against the evolving threat landscape across on-premises, private cloud, public cloud and multi-cloud workloads.
Our goal is to go beyond traditional security controls to deliver cloud-native, DevOps-centric and fully integrated 24x7x365 cyber defence capabilities that deliver a proactive, threat-informed, risk-based, intelligence-driven approach to detecting and responding to threats.
Our mission is to help our customers:
- Proactively detect and respond to cyber-attacks – 24x7x365.
- Defend against new and emerging risks that impact their business.
- Reduce their attack surface across private cloud, hybrid cloud, public cloud, and multi-cloud environments.
- Reduce their exposure to risks that impact their identity and brand.
- Develop operational resilience.
- Maintain compliance with legal, regulatory and compliance obligations.
Key Accountabilities
- Assist with customer onboarding by configuring and integrating data feeds into SIEM platforms with primary focus on Microsoft Sentinel and Elastic Security. Good to have experience in Splunk, IBM QRadar, and Google SecOps (Chronicle)
- Ensure the Customer’s operational and production environment remains healthy and secure at all the times.
- Onboard and integrate on-premises and cloud resources into Elastic SIEM, MS Sentinel, ensuring reliable security log ingestion, parsing, and monitoring.
- Develop custom dashboards and reporting templates.
- Develop complex to customer specific use cases.
- Advance platform administration, ideally through a DevOps-centric approach.
- Solution recommendation for issues.
- Co-ordinate with vendor for issue resolution.
- Basic and Intermediate Playbook and workflow enhancement.
- Maintain close working relationships with relevant teams and individual key stakeholders, such as incident response and disaster recovery teams as well as information security etc.
- Develop the custom parsers for the Incident and alert enrichment.
- Problem specific playbook and workflow creation and enhancements
· Required to work flexible timings.
Skills & Experience
- Should have relevant experience of 8+ years.
- Proven experience in administering, configuring, and supporting Microsoft Sentinel and Elastic Security (Elastic SIEM) in large-scale cloud and enterprise environments, with the ability to independently manage SIEM operations, onboarding, integrations, and troubleshooting.
- Elastic SIEM / Elastic Security (mandatory): Strong hands-on expertise in Elasticsearch, Kibana, Elastic Agent, Fleet, Logstash, data ingestion, integration management, parsing, ECS normalization, detection rules, alerts, dashboards, and incident investigation.
- Cloud Security Monitoring: Experience integrating and monitoring security logs from Microsoft Azure, Microsoft 365, GCP and AWS environments within Elastic Security.
- Microsoft Security Integration: Experience onboarding and analyzing security telemetry from Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Defender for Cloud, and Microsoft Defender for Office 365.
- Endpoint Detection & Response (EDR): Experience integrating and monitoring endpoint security events from solutions such as CrowdStrike and Microsoft Defender for Endpoint.
- Network Security Integration: Experience onboarding and troubleshooting security logs from firewalls and network security platforms, including Palo Alto, Fortinet, Juniper, and Cisco.
- Web Application Firewall (WAF): Experience integrating and monitoring WAF logs from Cloudflare, Akamai, and Azure WAF.
- Email Security: Experience integrating and analyzing email security telemetry from Proofpoint, Mimecast, and Microsoft Defender for Office 365.
- Data Loss Prevention (DLP): Experience integrating and monitoring DLP events from Microsoft Purview, McAfee, and Symantec solutions.
- AWS Security Monitoring: Experience onboarding and analyzing AWS security logs and findings from AWS Security Hub, GuardDuty, Macie, AWS Config, and CloudTrail.
- Experience integration GCP logs into SIEM tools.
- SIEM Administration & Troubleshooting: Ability to independently troubleshoot ingestion failures, parsing issues, integration errors, agent health, data gaps, and performance problems, and to optimize data ingestion, retention, and storage.
- Detection Engineering & Operations: Experience developing and maintaining detection rules, alerting workflows, dashboards, and investigation queries to support SOC monitoring and incident response.
- Independent Ownership: Ability to take end-to-end ownership of the Elastic Security platform, from initial deployment and data source onboarding through ongoing administration, maintenance, optimization, and operational support.
- Experience of security controls, such as network access controls; identity, authentication, and access management controls (IAAM); and intrusion detection and prevention controls.
- Knowledge of security standards (good practice) such as NIST, ISO27001, CIS (Center for Internet Security), OWASP and Cloud Controls Matrix (CCM) etc.
- Knowledge of scripting and coding with languages such as Terraform, python, javascript, golang, bash and/or powershell.
- Knowledge of DevOps practices such as CI/CD, Azure DevOps, CircleCI, GitHub Actions, Ansible and/or Jenkins.
Desired Certifications:
Holds one, or more, of the following certificates (or equivalent): -
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- Elastic Certified SIEM Analyst / Elastic Certified Engineer
- CompTIA Security+ / CySA+ or equivalent security certification is desirable.
o GIAC Security Operations Certified (GSOC)
o Certified Information Security Systems Professional (CISSP)
Soft Skills
- Self-motivated, proactive, and customer-focused professional.
- Strong analytical, troubleshooting, and problem-solving abilities.
- Excellent organizational and time-management skills.
- Ability to prioritize multiple incidents in a fast-paced operational environment.
- Strong verbal and written communication skills with technical and non-technical stakeholders.
- Demonstrated commitment to customer satisfaction and continuous improvement.
- Ability to work independently while collaborating effectively across teams.
Willingness to work flexible schedules and support critical customer situations
About Rackspace Technology
Rackspace Technology is the trusted operator of the full enterprise AI stack, from governed private cloud to AI inference and agents in production. From edge to core to cloud, we operate the infrastructure, data layer, and software integration to deliver business outcomes with the predictable cost, reliability, security, and compliance that regulated and mission-critical environments demand. We support customers in more than 120 countries with AI capabilities spanning private cloud, public cloud, applications, data and cyber resilience.
More on Rackspace Technology
Though we’re all different, Rackers thrive through our connection to a central goal: to be a valued member of a winning team on an inspiring mission. We bring our whole selves to work every day. And we embrace the notion that unique perspectives fuel innovation and enable us to best serve our customers and communities around the globe. We welcome you to apply today and want you to know that we are committed to offering equal employment opportunity without regard to age, color, disability, gender reassignment or identity or expression, genetic information, marital or civil partner status, pregnancy or maternity status, military or veteran status, nationality, ethnic or national origin, race, religion or belief, sexual orientation, or any legally protected characteristic. If you have a disability or special need that requires accommodation, please let us know.
