Splunk Admin - L1/L2/L3

Client OS: Windows 7, Windows 8, Windows 10, Linux, RHEL, Ubuntu, CentOS. Server OS: Windows Server 2008, Windows Server 2012, Linux Splunk ES Implementation, integration Integration of threat intelligence tools MISP with Splunk UBA SOAR Firewalls: FortiGate, Checkpoint, WAF: Imperva Administration and Operation role of Splunk. Team Lead Deployment and implementation of multiple forwarders and device integrations Administration of existing setup of Splunk SIEM architecture with upgradation and finetuning activities Managing Splunk customers. Splunk Core Certified Admin. Responsible for the SIEM management and upkeep Content development & management Operations management & troubleshooting of UBA Solution Operations management & troubleshooting of SOAR Solution SOAR playbook development for end-to-end automation Analyse network traffic using enterprise tools (e.g., SIEM, Full PCAP, Firewall, Proxy logs, IDS logs, etc). Analysis network monitoring, including IPS, WAF, PCAP, and NetFlow tools. Incident Escalation management Splunk Implementation, Integration, Fine-tuning, and administration. Splunk Content Development (filters, queries, variables, trends, reports, saved searches, etc.) Device Integration or configure log event sources with Splunk SIEM Verifying or conducting log collection failover scenarios As-Built Documentation Perform Triaging, false positive removal, and incident response. Coordinating with teams and resolving unsolved incidents. Hands-on experience in Incident Response activities like Malware analysis Work with vendor partners to monitor security products for evidence of unauthorized activities or violations of the organization's security policies, standards, and procedures and report incidents and violations to management. Develop, implement, and execute control activities to ensure that security products, processes, and procedures work as intended; remediate any detected deficiencies. Work with customer to track the overall SOC maturity process