Senior Security Implementation Specialist (Remote, CA)

Responsibilities

• Plan, design, test, and deploy log source integrations into Microsoft Sentinel and CrowdStrike Falcon Next-Gen SIEM.
• Act as the subject matter expert for Microsoft Sentinel and provide expertise in SIEM engineering and onboarding activities.
• Design and maintain Microsoft Sentinel data collection capabilities, including data connectors, Data Collection Rules (DCRs), KQL transformations, custom tables, Azure Monitor Agent deployment, syslog/CEF forwarding, and custom log ingestion.
• Design and maintain CrowdStrike Falcon Next-Gen SIEM onboarding capabilities, including data connectors, Falcon Log Collector deployments, HEC ingestion, routing pipelines, and custom parsers.
• Build and maintain API-based integrations and automation scripts using technologies such as REST APIs, PowerShell, Python, and Bash.
• Optimize data ingestion for quality, completeness, normalization, and cost efficiency.
• Validate onboarded data sources, including parsing accuracy, field mapping, data health, latency, and coverage.
• Develop and deliver operational handover documentation for the Security Operations Center, including onboarding checklists, data dictionaries, monitoring guidance, known limitations, and operational runbooks.
• Maintain log source inventories, technical documentation, and onboarding backlogs.
• Perform ad hoc firewall changes and provide recommendations related to network architecture, hardening, segmentation, log transport, and collector placement.
• Contribute to the architecture, design, implementation, and integration of the Claroty OT security platform.
• Partner with project managers, customers, and technical teams to deliver successful security solutions.
• Identify opportunities for process improvement and contribute thought leadership to the evolution of SIEM engineering practices.
• Perform other related duties as required within the scope of the role