Aviva India - Senior Security Engineer - SIEM/ArcSight

Position Summary : - Manage, monitor, and optimize global (GSOC) and local SOC environments. - Protect enterprise data using advanced DLP strategies. - Detect, analyze, and mitigate cyber threats across endpoints, proxies, and cloud infrastructure using SIEM, EDR, and automation tools. Key Responsibilities : SOC Operations & Incident Response : - Triaging alerts : Monitor global and local SOC environments for real-time security events. - Incident investigation : Execute standard Incident Playbooks to contain and neutralize threats. - Forensic analysis : Conduct root cause analysis on network and endpoint security incidents. - Threat hunting : Search logs proactively to identify undetected malicious activities. SIEM Management & Engineering (ArcSight) : - Platform administration : Manage and configure ArcSight SIEM Manager. - Log parsing : Develop and maintain custom ArcSight Parsers for unique log sources. - Rule optimization : Fine-tune SIEM use cases to reduce false positive alerts. - Data correlation : Create correlation rules to detect complex attack patterns. Data Loss Prevention (DLP) Strategy : - Policy engineering : Design, deploy, and maintain corporate DLP policies across the enterprise. - Tool management : Configure and manage Symantec DLP tools and technologies. - Incident mitigation : Monitor, detect, and respond to unauthorized data transfers. - Access governance : Implement data encryption practices to safeguard sensitive information. Endpoint & Infrastructure Security : - EDR management : Deploy and maintain Endpoint Detection and Response (EDR) solutions. - Vulnerability scanning : Run network and system vulnerability assessments using Nessus. - Endpoint control : Use Tanium for real-time asset discovery and endpoint management. - Access controls : Manage secure web gateways (Proxies) and Mobile Device Management (MDM). Automation & Orchestration : - Playbook development : Build automated workflows within the SOAR platform. - Process optimization : Streamline response times by automating repetitive analyst tasks. - Tool integration : Connect SIEM, EDR, and DLP tools into the SOAR ecosystem. Required Technical Skills : - SIEM : ArcSight SIEM Manager, ArcSight Parser development. - DLP : Symantec DLP Tool, policy creation, data classification. - Automation : Security Orchestration, Automation, and Response (SOAR) playbooks. - Vulnerability & Endpoint : Nessus, Tanium, EDR platforms. - Network & Mobility : Secure Web Proxies, Mobile Device Management (MDM). - Core Security : Cryptography/Encryption standards, threat hunting methodologies, digital forensics. Preferred Qualifications : - Experience working in a hybrid GSOC / Local SOC architecture. - Industry certifications : CISSP, CEH, GCIH, or platform-specific certifications (ArcSight, Symantec, Tanium). Work Environment : - This position may involve working in an office setting or remotely, depending on company policies and flexibility in hours may be required to meet team needs. Additional Information : - Shift : General. Five days working! - Head office & Interview location : Aviva India (HO) 401A, 4th Floor, Dlf Cyber Park, Phase II, Block A, Sector 20, Gurugram, Haryana 122002.