|Must Have Top 3-5 Skills: |
Experience working within (or with) SOC and Threat Intel teams experience – This work leverages insights from those functions to deliver effective threat detection content in SIEM and UEBA systems.
Good understanding of NIST 800-53, MITRE ATT&CK and use case ideation methodology –
You will help identify applicable use cases for business services (with input from SOC/Threat Intel).
You will not simply be given prescriptive instruction on precisely what content to write, you must be able to ideate and rationalize use cases Strong Splunk Enterprise Security content development skillset. UBA platform experience is a + Good written and verbal communication skills, as this work entails documentation writing and function representation as a SME in meetings with business units. •
prefer local candidates from the DC metro area as it would allow for more opportunity for focused interfacing with Cyber Security Operations staff, Not a hard requirement. future requirement for quarterly office visits and collaboration sessions that may require travel a couple times per calendar year.
Serves as Splunk content developer responsible for creating Security Information and Event Management (SIEM) content to monitor security events and detect potential security incidents across the Marriott enterprise. Responsible for SIEM content management, content creation, rule tuning, reporting and alert creation. Produces high-quality documentation pertaining to monitoring and content creation tasks. Leverages knowledge of monitoring, analyzing, detecting, and responding to cyber events and incidents to develop and implement effective monitoring and alerting for information systems and networks. Leads collaboration sessions for security monitoring use case identification and scoping with partners in the cyber security tower and other business units.
Education and Experience
- Bachelor’s degree in Computer Sciences or related field or equivalent experience/certification
- 3+ years of experience in:
- Splunk SIEM (Splunk Enterprise Security) content development
- 5+ years of experience in some or all of the following:
- Experience working in (or with) security functions such as SOC, CIRT, security engineering, risk management, vulnerability management.
- Technical infrastructure operations, administration, or systems engineering
- Scripting or programming language, including Python
- Agile methodology
- Current information security certification such as Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP) or an equivalent.
- Splunk Certification, including Splunk Enterprise Security Certified Admin
- Working knowledge of the NIST Cyber Security Framework and ISO/IEC 27001:2013
- Working knowledge of the MITRE ATT&CK Framework
- Experience with security monitoring use case ideation for various systems and services
- Familiarity with cloud service provider platforms (AWS, Azure, GCP), identity and access management systems, firewalls, next-gen anti-malware, intrusion detection and prevention systems
- Splunk SIEM and logging architecture, operations and management
- Experience with Linux, Unix and Microsoft operating systems
- Knowledge of IP networking
- Experience with a scripting language (*nix shell scripting, Python, PowerShell, etc.) and regular expressions
- Solid written and verbal communication skills
What You’ll be Doing:
- Lead collaboration sessions within the cyber security tower and other business units to devise security monitoring use cases. This work entails the collection and collaborative analysis of security accreditation reports, threat models, documented security controls, architecture, and business usage patterns for security monitoring consideration.
- Document prospective security monitoring use cases with MITRE ATT&ACK mappings using standard templates and methodologies. Identified use cases will be reviewed with stakeholders for acceptance sign-off and to move forward with development.
- Work with SIEM engineers and other engineering and operations teams to identify and notify team members of required data onboarding and integrations for use case development.
- Develop analytics, correlation searches, dashboards, reports and alerts within the SIEM and UEBA platform.
- Solicit feedback for pre-production security monitoring content through peer review process and user acceptance testing for tuning.
- Document developed security monitoring content in documentation registry using standard templates and methodology.
- Collaborate with the Cyber Incident Response Team and other business units to develop incident response playbooks for developed security monitoring content using standard templates.
- Manage field mapping and transmission of security monitoring alerts to the security incident response platform for SOC analyst consumption as outlined in process documentation.
- Service minor operational requests in queue such as performance tuning, filtering, or search refinement.
- Contribute to ongoing development and maintenance of documented standards, workflows, and best practices within the security monitoring content development discipline.
- Research emerging threats and adversary tactics, techniques, and procedures to understand the threat landscape and to ensure that security monitoring content remains relevant and effective.
- Provide governance support for the content development function entailing content development standards compliance, change management approvals for SIEM content, and lifecycle management of developed security monitoring content.
- Occasional participation in evaluations of new platforms, technologies and methodologies pertaining to security monitoring.
- Attend SCRUM and prioritization meetings to review and update deliverables.