SIEM Lead Cyber Security

apnconsultinginc -•Plano, TX

23h

About The Position

The SIEM Lead Cyber Security oversees the selection, implementation, integration, and ongoing management of incident response tools, including SIEM, EDR, IDS/IPS, and forensic tools. The role ensures tools are appropriately configured, maintained, optimized, and aligned with emerging threats and organizational needs. It also manages tool upgrades, migrations, licensing, renewals, and vendor relationships. The role uses these tools to detect, investigate, and respond to security incidents; conduct in-depth analysis and forensic investigations; identify root causes; and determine remediation actions. It leads efforts to automate incident response, establishes tool-use best practices, and works with security operations, vulnerability management, IT, legal, and compliance teams. The position also provides training and mentorship, maintains documentation, supports audits and assessments, reports on tool performance and incident response metrics, and contributes to continuous improvement through post-incident reviews.

Requirements

Extensive experience with incident response tools, such as SIEM (e.g., Splunk, QRadar, Microsoft Sentinel), EDR (e.g., CrowdStrike, Carbon Black), IDS/IPS (e.g., Snort, Suricata), and forensic tools (e.g., EnCase, FTK).
Strong understanding of cybersecurity concepts, including network security, endpoint security, and threat detection.
Proficiency in scripting languages such as Python or PowerShell for automation and integration.
Demonstrated experience deploying, configuring, and managing incident response tools in a large, complex environment.
Ability to optimize tools for performance, including tuning alerts, refining rules, and integrating with other security systems.
Knowledge of incident response tool management best practices and ability to implement them across an organization.
Strong analytical skills to interpret data from multiple tools and identify patterns indicative of security incidents.
Ability to troubleshoot tool issues and resolve them in a timely manner.
Experience conducting root cause analysis and forensic investigations using incident response tools.
Excellent written and verbal communication skills, including the ability to explain complex technical concepts to non-technical stakeholders.
Strong collaboration skills and ability to work with cross-functional teams, including IT, legal, and compliance.
Ability to develop and deliver training on incident response tools.
Experience mentoring and guiding junior engineers in the use of incident response tools and best practices.

Responsibilities

Oversee the selection, implementation, integration, configuration, and management of incident response tools, including SIEM, EDR, IDS/IPS, and forensic tools.
Ensure tools capture necessary data and regularly review and update configurations to address emerging threats and organizational needs.
Optimize tool performance, including tuning alerts, refining rules, and integrating tools with other security systems and platforms.
Develop and implement best practices for using incident response tools across the cybersecurity team.
Use incident response tools to detect, investigate, and respond to security incidents; conduct in-depth analysis to identify root causes and appropriate remediation actions.
Lead efforts to automate incident response processes using scripting and tool capabilities.
Keep tools current with patches, updates, and configurations; manage licenses, renewals, vendor relationships, upgrades, and migrations.
Collaborate with security operations, vulnerability management, IT, legal, and compliance teams on effective and compliant tool use.
Train and guide team members and stakeholders, and mentor junior engineers in tool use and best practices.
Stay informed about incident response technology developments and share insights with the cybersecurity team.
Participate in post-incident reviews and recommend improvements to tools and processes.
Develop and maintain documentation concerning tool configuration and use.
Ensure tool use complies with legal, regulatory, and organizational policies.
Generate reports on tool performance, incident response metrics, and tool effectiveness.
Assist with audits and assessments related to incident response tool management.