Sr. Lead

About The Company
Tata Communications Redefines Connectivity with Innovation and IntelligenceDriving the next level of intelligence powered by Cloud, Mobility, Internet of Things, Collaboration, Security, Media services and Network services, we at Tata Communications are envisaging a New World of Communications

Job Description

• Responsible for managing customer queries related to all services and solutions delivered, including diagnosing, and resolving complex technical issues in Cloud & Security domain. The role acts as a conduit between customers and other teams such as engineering, architecture etc. for any issue resolution. This is an operational role, responsible for delivering results that have a direct impact on day-to-day operations and capable of instructing professional or technical staff and reviewing the quality of the work undertaken by these roles.

Responsibilities

• NG SIEM (SIEM+SOAR+UEBA) Tool Overall Administration, Management, Backup &

Archival, Troubleshooting

• Upgrade/Update/Patching/Backup/Archival of NG SIEM Solution
• Monitor NG SIEM Console & Dashboards and provide response & support to remote SOC

team for Incidents.

• Support the day-to-day operation of deployed NG SIEM (SIEM+SOAR+UEBA)
• Perform initial analysis for known issues and provide the appropriate recommendations

for closure.

• Monitor & Reporting of system components health and take necessary action in case of

any observed issue.

• Integration of NG SIEM with IS infrastructure (Existing/Future) but not limited to like IPS,

WAF, Patch Management, Firewall, Anti-APT solution, Antivirus, EDR, AD, ERP, DLP,

VMT, Exchange, SharePoint, Network Devices, Web Services, Custom applications etc. &

also on respective version upgrade(s) . -(Continuous)

• Develop appropriate use cases/playbooks/models/reports and alerts & develop custom

parsers/connectors for integrating logs wherever necessary or required. L3 should have

a good command on Regex, Parser & Playbook creation. No separate charges will be

provided for Parser or Play book creation.

• Integration of SIEM/SOAR/UEBA Tool with security/non-security solutions based on

requirement & architecture and develop/modify appropriate use cases/rules,

playbooks/models, reports and alerts – (Continuous)

• Should provide real time situational awareness to the Client stakeholders.
• Use and apply learnings from incident and provide recommendation for standardizing the

NG SIEM (SIEM+SOAR+UEBA) Solution.

• Reduction of False Positives by fine tuning existing correlation

rules/configuration/playbooks/models

• Automation with continuous improvements, Reduction in MTTR, MTTD
• Develop and implement processes for interfacing with Operational teams and other

supporting teams.

• Ensure the NG SIEM (SIEM+SOAR+UEBA) integration is intact among the Client SOC

solutions, other assets

• Design, create and customize the dashboards/reports as per the Client requirements.

Customise & fine tune SIEM, SOAR, UEBA Dashboards.

• Ensure the necessary Client SOC documents like operating procedures, configuration

management, Low Level Design etc. are up to date with the changes made in their

respective areas.

• Automating Day to Day Tasks related with NG SIEM Operations (but not limited to)
• Above is illustrative list of general activities. All Technology specific activities Related to

NG SIEM to be carried out.

• Use and apply learnings from incident and provide recommendation for standardizing the

NG SIEM Solution.

• Support on boarding and maintenance of a wide variety of data sources to include various

OS, appliance, and application logs. Create Custom parser, queries, custom dashboards,

and visualizations

• Create and manage NG SIEM knowledge objects to include apps, dashboards, saved and

scheduled searches and alerts

• Support access requests and modifications and permissions
• Support troubleshooting and remediation of issues as they arise with data ingestion and

NG SIEM infrastructure

• Creating & updating all SOPs & support for fulfilling Audit requirements.
• Monitor & report on cyber threats and suggest any changes needed to protect the

organization in SIEM, Leading End-to-End Implementation of the suggested changes.

• Provide notification and communication with Incident management and respective

application team upon threat detection.

• Perform analysis on the reported incidents, determine the root cause, and recommend

the appropriate solution.

• Should have a very good understanding on MITRE att&ck & NIST framework.
• Work on Improvement of overall posture of NG SIEM deployment to achieve best return

on investment. Coordinate with Analyst team for finetuning & improving NG SIEM overall

utilization/usage & enriching security posture of Client

Desired Skill sets

Good hands on and knowledge to manage SIEM - ArcSight (Micro focus) , SOAR+UEBA - ArcSight(Micro focus)

• Good knowledge on implementation, installation, integration troubleshooting and overall functionalities
• Experience in troubleshooting platform related issues, data backup, restoration, retention
• Maintains awareness of latest technologies in the domain