Job Responsibilities:● Working in a 24x7 Security Operations Center● Monitoring the customer network using Splunk SIEM● Act as first level support for all Security Issues● Analyzing Realtime security incidents and checking whether its true positive or false positive● Performing Real-Time Monitoring, Investigation, Analysis, Reporting and Escalations of Security Events from Multiple log sources.● Raising true positive incidents to the respective team for further action● Creating tickets on service now and assigning it to the respective team and taking the follow-up until closer ● Escalating the security incidents based on the client's SLA and providing meaningful information related to security incidents by doing in-depth analysis of event payload, providing recommendations regarding security incidents mitigation which in turn makes the customer business safe and secure.● Contacting the customers directly in case of high priority incidents and helping the customer in the process of mitigating the attacks.● Investigate malicious phishing emails, domains, and IPs using Open-Source tools and recommend proper blocking based on analysis● Good knowledge of Splunk Distributed cluster Architecture● Detail knowledge of the working functionality of various components of Splunk such as Indexer, Search head, Heavy forwarder, deployment server etc.● Experience in onboarding of data sources with Splunk such as Windows, Linux, Fortinet Firewall etc.● Installing Splunk apps and Addon on the Splunk● Experience in installation of Universal forwarder on the servers for logs collection ● Responsible for upgrading the Forwarders to the newer versions● Doing the troubleshooting incase any device is not reporting to the Splunk ● Knowledge of Creating dashboard, Reports in Splunk● Knowledge and experience in creating Correlation Searches/Rules in Splunk● Working experience searching and Reporting in Splunk having good SPL knowledge