Managed Services Consultant

We are looking for an experienced Managed Services Consultant specializing in Splunk SIEM to administer, maintain, and enhance enterprise security monitoring solutions. The ideal candidate will have strong hands-on experience with Splunk Enterprise administration, Splunk Enterprise Security (ES), log-source onboarding, detection engineering, and Splunk User Behavior Analytics (UBA).

• Administer Splunk Enterprise, including deployment, configuration, user management, license monitoring, upgrades, patching, backup, and recovery.

• Onboard new log sources and troubleshoot ingestion failures, parsing issues, and data-quality problems.

• Develop and maintain Splunk Enterprise Security use cases, correlation searches, alerts, dashboards, reports, and queries.

• Create custom correlation rules based on business and security requirements.

• Monitor log-source availability and resolve SIEM-related incidents and support tickets.

• Develop parsing and normalization rules for non-standard logs and diverse data formats.

• Integrate threat intelligence feeds, IoCs, Sigma-based detections, and relevant regulatory security advisories.

• Administer Splunk UBA, including data ingestion, health monitoring, backup, and failover.

• Support ingestion of CIM-compliant security data, raw events, and HR data into Splunk UBA.

• Review existing configurations and recommend improvements to performance, reliability, and detection coverage.

• Support regulatory audits in Saudi Arabia by providing relevant SIEM evidence and reports.

• Maintain technical documentation, change records, and operational procedures.

• Minimum 5 years of relevant IT security, SIEM, or cybersecurity experience.

• Strong hands-on experience administering Splunk Enterprise in production environments.

• Practical experience with Splunk Enterprise Security and security use-case development.

• Strong SPL skills and knowledge of data onboarding, parsing, field extraction, and normalization.

• Experience troubleshooting forwarders, data ingestion, indexing, and search performance.

• Knowledge of Splunk UBA administration, data integration, monitoring, and recovery procedures.

• Familiarity with threat intelligence, IoCs, Sigma rules, and security detection engineering.

• Understanding of security monitoring, incident response, change management, and audit requirements.

• Strong analytical, troubleshooting, documentation, and communication skills.