Deskripsi pekerjaan Security Engineer (SIEM) PT. Nusa Network Prakarsa
A Security Engineer focusing on Security Information and Event Management (SIEM) is responsible for designing, implementing, and managing systems and software that monitor, detect, and respond to security incidents. Here are some key responsibilities and skills for this role:
Key Responsibilities:
1. SIEM Implementation and Management:
- Install, configure, and manage SIEM tools like Splunk, QRadar, ArcSight, or LogRhythm.
- Develop and implement rules, alerts, and dashboards for real-time security monitoring.
2. Incident Detection and Response:
- Monitor security events and incidents, analyzing logs and alerts from various sources.
- Respond to security incidents by conducting initial triage, analysis, and remediation.
3. Threat Intelligence:
- Integrate threat intelligence feeds into the SIEM to enhance detection capabilities.
- Stay updated with the latest threats and vulnerabilities to ensure the SIEM is tuned accordingly.
4. Log Management:
- Ensure comprehensive logging from all critical systems and applications.
- Manage log retention policies in compliance with regulatory and organizational requirements.
5. Automation and Scripting:
- Develop automation scripts to streamline SIEM operations and incident response.
- Use scripting languages like Python, PowerShell, or Bash for custom integrations and automations.
6. Compliance and Reporting:
- Generate and maintain compliance reports (e.g., PCI-DSS, HIPAA, GDPR).
- Conduct regular audits to ensure adherence to security policies and standards.
7. Collaboration:
- Work with other IT and security teams to ensure cohesive security operations.
- Provide training and guidance to other team members on SIEM capabilities and best practices.
Key Skills:
1. Technical Proficiency:
- Deep understanding of SIEM technologies and architecture.
- Proficiency with network protocols, system logs, and security events.
2. Analytical Skills:
- Strong analytical skills to identify, assess, and respond to security incidents.
- Ability to perform root cause analysis and post-incident reviews.
3. Programming and Scripting:
- Experience with scripting languages for automation (Python, PowerShell, Bash).
- Familiarity with regular expressions for log parsing and analysis.
4. Security Knowledge:
- In-depth knowledge of cybersecurity principles, threat landscape, and attack vectors.
- Understanding of security frameworks and compliance standards.
5. Problem-Solving:
- Strong problem-solving skills to address and mitigate security issues effectively.
- Ability to think critically and make informed decisions under pressure.
6. Communication Skills:
- Excellent verbal and written communication skills for reporting and collaboration.
- Ability to explain technical concepts to non-technical stakeholders.
Certifications (Optional but Beneficial):
- Certified Information Systems Security Professional (CISSP)
- Certified Information Security Manager (CISM)
- Certified Information Systems Auditor (CISA)
- GIAC Security Essentials (GSEC)
- Splunk Certified User/Power User/Administrator
- IBM Certified Deployment Professional - QRadar SIEM
Tools and Technologies:
- SIEM Solutions: Wazuh, Splunk, IBM QRadar, ArcSight, LogRhythm, AlienVault.
- Threat Intelligence Platforms: ThreatConnect, Anomali, Recorded Future.
- Log Management: ELK Stack (Elasticsearch, Logstash, Kibana), Graylog.
- Automation Tools: Ansible, Puppet, Chef.
- Scripting Languages: Python, PowerShell, Bash.
