SIEM & EDR Engineer (Sentinel, LogRhythm & Defender EDR)

HelpAG is looking for SIEM & EDR Engineer who will be responsible for the creation of procedures, implementation of process development, and maintenance of security systems across the client environment. The Engineer will work closely with Management, Senior Engineers, Threat Analysts, Solution Architects, other Security Engineers, and clients to complete high profile, critical services to existing Managed Security Service clients.

This position will be based in Ajman, UAE and will be responsible for the administration, maintenance, and integration of Azure Sentinel, LogRhythm SIEM and SOAR, TM EDR and Nessus (for vulnerability assessments) security platforms, operations technical analysis, assessment, and recommendations in the areas of real-time security, operational network &identity management system,and applications systems security monitoring.

Responsibilities

• Design, implement, and support SIEM solutions, preferably Sentinel & LogRhythm.
• Deep understanding of sentinel & LogRhythm SIEM components & health checks, ability to develop custom parsers, dashboards & reports.
• Integrating a wide variety of data sources with Sentinel and LogRhythm SIEMs.
• Engaging with application and infrastructure teams to establish best practices for utilizing Sentinel and LogRhythm data and visualizations.
• Tune and troubleshoot Sentinel and LogRhythm SIEM to deliver optimal performance in high volume enterprise customer environments.
• Hands on Experience in Administrating and managing LogRhythm SOAR or any other SOAR platform, preparing Playbooks configuring automation workflows.
• Handle the implementation/deployment/support of Nessus scan engines and peripherals with Engineering, SOC, TIU, and IR.
• Maintain local and network credentials, Tenable Security Center, and provisions access to vulnerability scanning systems.
• Integrate Nessus/TSC with other security and IT systems management tools.
• Document vulnerabilities and work on vulnerability mitigation with agreed SLA
• Managing TM EDR including deployment, operation, management, maintenance, update, upgrade, patching, and administration.
• Should be able to create syntaxes to detect indicators of compromise (IOCs) and malicious behavior of new threats.
• Hands on in writing a query in Sentinel, LR & TM EDR to search the desired events.
• Hands on experience in Web Inspect application security testing.

• College degree or equivalent training with experience working in Device Managed Services, or client network environment.
• Minimum 5 years of proven experience supporting and maintaining Sentinel, Logrhythm, MVA, EDR.
• Professional experience working with networks and network architecture.
• Practical hands-on experience in Sentinel, Logrhytm SIEM and SOAR, EDR (TrendMicro) Nessus and web Inspect.
• Azure Log analytics, or equivalent big data engine experience.
• Experience with MS Azure Information Protection and technologies, including solution architecture, deployment, management, and support in a large global enterprise.
• Good to have Azure, Managed vulnerability (Nessus/Tenable), EDR, NDR and Next gen Firewall related security certifications.
• Knowledge of Linux and Windows Operating Systems.
• Experience with various other SIEM security products such as: Sentinel, Splunk, LogRhythm and infrastructure components such as proxies, firewalls, IDS/IPS, and DLP.
• Experience working with clients in a service delivery function.
• Shift flexibility, including the ability to provide after-hours support when needed.
• Experience working with internal and client ticketing and knowledge base systems for Incident and Problem tracking as well as procedures.

• Health insurance with one of the leading global providers for medical insurance
• Career progression and growth through challenging projects and work.
• Employee engagement and wellness campaigns activities throughout the year.
• Excellent learning and development opportunities.
• Annual flight tickets to home country.
• Inclusive and diverse working environment.
• Flexible/hybrid working environment.
• Open-door policy.

Help AG is the cybersecurity arm of e& enterprise (formerly Etisalat Digital) and provides leading enterprise businesses across the Middle East with strategic consultancy combined with tailored information security solutions and services that address their diverse requirements, enabling them to evolve securely with a competitive edge.

Present in the Middle East since 2004, Help AG was strategically acquired by e& (formerly Etisalat Group) in 2020, hence creating a cybersecurity and digital transformation powerhouse in the region.

Help AG has firmly established itself as the region's trusted IT security advisor by remaining vendor-agnostic, trustworthy, independent, and maintaining its focus on all aspects of cybersecurity. With best of breed technologies from industry-leading vendor partners, expertly qualified service delivery teams and a state-of-the-art consulting practice, Help AG delivers unmatched value to its customers by strengthening their cyber defenses and safeguarding their business.