The posting
Job Designation: SEIM Administrator
Experience: 3+ years
Location: Ahmedabad
SIEM Administration & Monitoring
- Administer and maintain SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, ArcSight, LogRhythm, or Elastic SIEM.
- Monitor security events, alerts, and incidents generated by the SIEM.
- Ensure continuous availability, performance, and health of the SIEM infrastructure.
- Perform platform upgrades, patching, and configuration management.
Log Management
- Integrate and onboard log sources including:Firewalls IDS/IPS Endpoint security solutions Servers and workstations Active Directory Cloud services (Azure, AWS, GCP) Network devices and applications
- Validate log collection, parsing, normalization, and retention policies.
- Troubleshoot log ingestion and data quality issues.
Security Use Cases & Detection Engineering
- Design, develop, and optimize security correlation rules and use cases.
- Create dashboards, reports, and threat-hunting queries.
- Reduce false positives through tuning and refinement of detection logic.
- Implement MITRE ATT&CK-based detection capabilities.
Incident Response Support
- Investigate SIEM-generated alerts and security incidents.
- Support SOC analysts during incident investigations.
- Perform root cause analysis and provide recommendations.
- Coordinate with internal teams for remediation and containment activities.
Compliance & Reporting
- Generate security reports for management and audit requirements.
- Support compliance initiatives such as ISO 27001, NIST, HIPAA, PCI-DSS, and SOC 2.
- Maintain documentation of SIEM architecture, use cases, and procedures.
Automation & Integration
- Integrate SIEM with SOAR tools and security technologies.
- Develop automation workflows to improve SOC efficiency.
- Utilize scripting to automate repetitive administrative tasks.
Required Qualifications
- Bachelor's degree in Cybersecurity, Information Security, Computer Science, or related field.
- 3+ years of experience in SIEM administration or SOC operations.
- Hands-on experience with one or more SIEM platforms:Microsoft Sentinel Splunk IBM QRadar ArcSight LogRhythm Elastic Security
- Strong understanding of security monitoring and incident response.
- Knowledge of network protocols, Windows/Linux systems, and cloud security.
Technical Skills
- SIEM Administration and Analytics
- Log Management and Event Correlation
- Threat Detection and Threat Hunting
- Security Incident Investigation
- Active Directory Security Monitoring
- Firewall and Network Security Monitoring
- KQL, SPL, SQL, or AQL Query Languages
- PowerShell, Python, or Bash Scripting
- MITRE ATT&CK Framework
- SOAR Integration and Automation
- Cloud Security Monitoring (Azure, AWS, GCP)
Preferred Certifications
- Microsoft Certified: Security Operations Analyst (SC-200)
- Microsoft Certified: Azure Security Engineer (AZ-500)
- Splunk Certified Admin / Power User
- IBM QRadar Certified Administrator
- CompTIA Security+
- CEH (Certified Ethical Hacker)
- GIAC Certifications (GCIA, GCIH)
- CISSP (Preferred)



