SIEM Analyst

Smart IMS•Harrisburg, PA

3d•Hybrid

About The Position

As a SIEM Analyst, you will provide hands-on engineering, administration, and operational support for an enterprise Security Information and Event Management (SIEM) platform. This role focuses on security monitoring, threat detection, log management, platform optimization, and integration of security technologies to strengthen the organization's cybersecurity posture.

Requirements

Strong experience administering and supporting enterprise SIEM platforms, preferably Splunk.
Experience onboarding, configuring, and managing security log sources and data integrations.
Expertise in developing detection rules, correlation searches, alerts, reports, and dashboards.
Knowledge of cybersecurity operations, threat detection, incident response, and log management practices.
Experience integrating SIEM platforms with cloud environments, security tools, and enterprise applications.
Strong troubleshooting skills related to SIEM performance, data ingestion, and platform operations.
Experience performing system upgrades, patch management, and configuration management activities.
Understanding of security monitoring best practices, threat hunting, and alert tuning methodologies.
Strong documentation, communication, analytical, and problem-solving skills.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent professional experience.

Responsibilities

Engineer, configure, maintain, and optimize enterprise SIEM platforms, including Splunk and related security technologies.
Onboard and manage new log sources, ensuring proper collection, parsing, normalization, indexing, and retention.
Develop and maintain correlation searches, alerts, dashboards, reports, and detection rules.
Integrate SIEM capabilities with cloud platforms, applications, security tools, and enterprise systems.
Monitor platform performance, capacity, availability, and overall health.
Tune alerts and detection logic to reduce false positives and improve monitoring effectiveness.
Support security operations and incident response teams with investigations, dashboards, queries, and reporting.
Perform platform upgrades, patching, testing, configuration changes, and infrastructure enhancements.
Create and maintain technical documentation, operational procedures, and knowledge-transfer materials.
Collaborate with security, infrastructure, networking, cloud, and application teams on cybersecurity initiatives.