Content Developer – Arcsight

Content Developer – Arcsight – 3-month contract (Quarterly Rolling) – £500 per day (Outside IR35) – Berkshire / Hybrid 

SIEM / ELK / EDR / CSOC / Arcsight

• In depth and extensive hands-on experience in security event analysis
• Deep knowledge of IPv4/IPv6, TCP networking protocols
• Deep knowledge of Windows/Linux operating systems
• Good working knowledge of security technologies such as SIEM (ArcSight, Sentinel, QRadar, LogRhythm, Splunk), EDR (Microsoft Defender, FireEye, Tanium), IDS/IPS, firewalls, proxies, web application firewalls, anti-virus, etc.
• Understanding of Window Security Event logs and Syslog
• Excellent familiarity with endpoint/perimeter security attack vectors and detection (blue/purple teaming)
• Familiarity with standard security frameworks such as MITRE, cyber kill chain and APT campaign strategies
• Good knowledge of cloud platforms such as Azure, O365, Google cloud, AWS, Oracle
• Good working knowledge of regular expression development
• Scripting and programming experience is highly desirable
• Kusto or SQL knowledge, including rule/query optimisation
• Proven ability to prioritise workload, meet deadlines and utilise time effectively
• Good interpersonal and communication skills, works effectively as a team player and the ability to communicate technical information to a non-technical audience