• Maintain the availability, performance, and functionality of the Splunk security monitoring platform on a 24/7 basis.
• Monitor the health and performance of security platforms, data pipelines, and log ingestion processes.
• Develop and maintain monitoring alerts to promptly identify faults, delays, or disruptions in log collection and correlation.
• Investigate platform issues and take appropriate action to restore services within the required service levels.
• Proactively identify data quality, configuration, and architectural issues that may affect threat detection or introduce security and operational risks.

Log Integration and Data Quality

• Identify, map, model, onboard, and correlate event logs from platforms and systems supporting Regional IT Security use cases.
• Ensure security event data is complete, accurate, timely, and suitable for monitoring, detection, investigation, and reporting.
• Support the integration of new log sources and security technologies into the monitoring platform.
• Perform data validation and troubleshooting to resolve issues affecting log collection, parsing, normalisation, enrichment, and correlation.
• Support data modelling and analytics activities and research new methods to improve data quality and detection capabilities.

Detection Engineering and Security Monitoring

• Develop, maintain, and enhance security monitoring use cases, correlation rules, dashboards, alerts, and detective controls.
• Work closely with security analysts to identify, investigate, remediate, and close potential security threats.
• Review the effectiveness of monitoring controls and recommend technical improvements where required.
• Maintain and enhance threat intelligence data feeds and their integration with security monitoring and correlation processes.
• Develop dashboards and controls supporting IT security oversight, control monitoring, assurance, and reporting requirements.

Automation and Engineering

• Develop scripts, automation, and technical solutions to improve the efficiency, consistency, and reliability of security operations.
• Identify recurring operational activities that can be automated or standardised.
• Support the evaluation, proof of concept, implementation, and rollout of security technologies used by the GSOC and LBU BISO teams.
• Contribute to initiatives involving Security Orchestration, Automation and Response (SOAR), metrics assurance, and related security capabilities.
• Proactively research emerging technologies, engineering practices, and security controls that may improve the organisation’s monitoring and response capabilities.

Technical Support and Stakeholder Engagement

• Provide timely technical support to the GSOC and LBU BISO teams for platform issues, service requests, and new integration initiatives.
• Manage requests and service tickets in accordance with agreed Service Level Agreements (SLAs).
• Provide technical guidance to stakeholders on the effective use of security monitoring platforms and associated capabilities.
• Coordinate with LBU BISO teams, infrastructure teams, application owners, security teams, and technology vendors to resolve technical issues and deliver security initiatives.
• Liaise with Service Delivery Managers and Security Engagement Managers to communicate project progress, operational matters, risks, dependencies, and business requirements.
• Ensure platform changes and deployments are aligned with the organisation’s change management processes.

Documentation and Continuous Improvement

• Develop and maintain accurate system documentation, technical procedures, operational processes, configuration records, and support guides.
• Develop and maintain Standard Operating Procedures (SOPs) for security engineering activities, roles, and responsibilities.
• Analyse recurring incidents and operational issues to identify trends, underlying causes, and opportunities for improvement.
• Report recurring problems to management and recommend appropriate process or technical improvements.
• Promote knowledge sharing across the team to reduce operational dependency on individual team members and minimise single points of failure.
• Work collaboratively with peers to ensure adequate operational coverage, knowledge transfer, and continuity of support.

Minimum Job Requirements

Education and Experience

• Bachelor’s degree in Computer Science, Information Systems, Computer Engineering, Cybersecurity, or a related discipline.
• Four to seven years of relevant experience in security engineering, platform engineering, systems integration, security operations, or a related technical field.
• Relevant professional or technical certifications would be an advantage.

Technical Skills

• Hands-on experience with enterprise log management or Security Information and Event Management (SIEM) platforms, preferably Splunk.
• Experience interpreting, searching, manipulating, correlating, and tuning security event data within an enterprise log management platform.
• Experience with at least one scripting or automation language, such as Python, PowerShell, or Perl.
• Good understanding of log collection, data parsing, data normalisation, event correlation, security monitoring, and incident detection concepts.
• Experience troubleshooting integrations between applications, infrastructure platforms, security tools, and data collection components.
• Familiarity with security monitoring technologies and capabilities such as SIEM, SOAR, EDR, threat intelligence, and cloud security monitoring.

Professional Skills

• Strong analytical, troubleshooting, and problem-solving skills.
• Self-motivated and able to work independently while collaborating effectively within a team.
• Able to work with both technical and non-technical stakeholders across different business units.
• Able to learn and apply new technologies, security concepts, and engineering practices quickly.
• Strong organisational skills with the ability to manage multiple operational priorities and technical assignments.
• Excellent written and verbal communication skills in English.
• Able to communicate technical information clearly to stakeholders with different levels of technical knowledge.

Preferred Certifications

• Splunk Certified Cybersecurity Defense Engineer
• Splunk Enterprise Security Certified Admin
• Other relevant cybersecurity, cloud, automation, or platform engineering certifications