Technical & Bus Analyst - Data & Applications

Job description

Must Have Technical/Functional Skills Technical Expertise

• 5+ years working with SIEM platforms (Splunk preferred).
• Advanced experience with CIM, ECS, or equivalent log normalization schemas.
• Strong understanding of: o JSON logging o Syslog/NXLog o Cloud logging architectures (AWS/GCP/Azure) o Application security telemetry o OSQuery / EDR / DNS / WAF logs

Proven ability to write

• o Source type definitions o Field extraction rules o Correlation logic o Detection playbooks

Cybersecurity Knowledge & Competency

• Familiarity with MITRE ATT&CK, SIGMA rules, NIST 800-53 frameworks.
• Experience supporting SOC, IR, SIEM, Detection Engineering, or Threat Ops teams.
• Understanding modern attack techniques, identity abuse patterns, and cloud threats.

Roles & Responsibilities

• Engage and coordinate with Application Owners, Product Teams, DevOps, and Engineering.
• Validate log types, formats, schemas, and logging methods (syslog, API, CloudTrail, JSON, custom formats).
• Define onboarding requirements including event types, fields, timestamps, user identity, error codes,
• and security-critical attributes.
• Evaluate logs for completeness, reliability, and compliance with industry standard schemas.
• Map log sources to Splunk’s Common Information Model (CIM) or equivalent normalization frameworks.
• Log parsing, field extraction, enrichment, and timestamp normalization.
• Development of CIM-compliant extractions for all new log sources.
• Documentation of field dictionaries, mappings, and SIEM source type definitions.
• Validation of proper taxonomy alignment across categories such as: o Authentication o Authorization o Application activity o Network activity o Security events o Error/failure conditions o Administrative and privileged actions
• Mapping application behaviors to relevant attack techniques (MITRE ATT&CK).
• Identifying and documenting detection opportunities.

Authoring and implementing

• o Correlation searches o Behavioral detections o Anomaly models o High-fidelity alert logic

Ensuring each detection has

• o Defined data dependencies o Operational owner o Severity/priority rating o Triage response play
• Operationalizing detections into Security Operations Runbooks, including: o Preconditions
• Indicators & patterns o Triage steps o Containment actions o Escalation paths o Evidence checklist Salary Range: $64,000 - $110000 a year #LI-CM2 </div