SIEM Administrator

SIEM Admin role

Location- Noida

Exp- 5+ years

Shift- 12-9pm / Hybrid

  Key Roles & Responsibilities – Sentinel SIEM Administrator

 

• Strong hands-on expertise in Microsoft Sentinel administration and architecture
• Proven experience in UEBA configuration and tuning, with deep understanding of behavior analytics
• Ability to design and implement custom UEBA rules aligned to organizational threat scenarios
• Sentinel content management including:

 

• Analytics rule creation and tuning
• Workbooks and dashboards
• Hunting queries and detections lifecycle management

 

• End-to-end custom use-case creation based on threat modeling and compliance requirements
• Expert-level KQL (Kusto Query Language) skills for detections, investigations, hunting, and performance optimization
• Log source onboarding expertise for:

 

• Native connectors.
• Third-party sources (firewalls, EDR, proxy, IAM, network/security devices)

 

• Hands-on experience in custom connector creation using REST APIs, AMA, Data Collection Rules, or Function Apps
• SOAR and Logic App expertise, including:

 

• Automation rule creation
• Custom playbook development
• Integration with ITSM and third-party security tools

 

• Experience reducing false positives, and improving SOC efficiency
• Ability to work closely with SOC L2/L3 and Infra teams for operationalization