The security information and event analyst (SIEM) analyst is responsible for the collection, analysis and validation of all Security information and event management (SIEM) activities that impact the organization either from within the network or outside its network. He/she is responsible for enrollment of information assets (servers, network devices, applications, databases and security solutions) into the SIEM tool for visibility on all security information and events activities within those assets, which are of interest to management and provide insight into attacks or attempts to compromise such organizational computer assets. A SIEM analyst is responsible for the migration of rules, queries and filters that will collect security information and events of interest to production or active database of the SIEM infrastructure while ensuring continuous routine maintenance of security tools and SIEM infrastructure. Security Information and Event Management (SIEM) analyst must be knowledgeable about the different threats and vulnerabilities that confront the organization, their sources and actors. He/she must understand the organization's business and the risk confronting the organization based on the nature of its business. As such, SIEM analyst must be privy to risk assessment, penetration test and vulnerability scan results conducted on all business and information assets of risk significance and the level of controls implemented by management to mitigate such risk. With adequate information of inherent risk, vulnerabilities and threats within the organization's information assets and IT infrastructure, a SIEM analyst would be able to set rules, filters and active monitoring channels to be able to capture security information and events of interest where they occur and by doing so, provide reasonable assurance to the management on the effectiveness of controls implemented to address the risk and plug the vulnerabilities/gaps that could unduly exposure the information assets/infrastructure of the organization to possible compromise.
The SIEM analyst produces and maintain (update) an security incident log that is a reflection of security events or incidents that occurred within the organization's network and IT infrastructure for which the SIEM analyst have visibility on and are reported to management on periodic basis for decision making purpose and as proof that implemented controls are effective and adequate while threats anticipated by the information security and cyber security teams are factored into SIEM infrastructure to give visibility on their occurrence to the SIEM analyst. The SIEM analyst where also acting as the SIEM administrator ensures the optimal running of the SIEM infrastructures and performs functions such as user access management, migration of rules, filters and use cases created by the SIEM analyst, creation and maintenance of active monitoring channels, definition and maintenance of log retention policy in the SIEM infrastructure in line with the organization's data retention policy, backup of the SIEM infrastructure, creation and implementation of flex connectors to capture/read logs of new solutions for which the SIEM's original equipment manufacturer (OEM) does not support, among others. Security information and event management (SIEM) analyst in conjunction with the SIEM administrator (if performed by a different person) are responsible for the tuning and optimization of the SIEM infrastructure to capture relevant/required security information and events of IT infrastructures of interest thereby minimize noise (i.e. irrelevant information and events) that does not have any bearing on the security posture of the organization. Research has shown that optimized SIEM infrastructure improve visibility of the SIEM analyst on critical security information and events that could impact the organization and provide sufficient insight on the attack surface of the organization's IT infrastructure while untuned or unoptimized SIEM infrastructure leads to increased chances of missing out on critical security information and events that could impact the organization or provide insight into the attack surface of the organization's critical IT assets. A SIEM analyst must be experienced and knowledgeable in information security issues as well as SIEM tool being used by his/her organization (e.g. HP Arcsight, IBM Qradar, McAfee SIEM, etc.) and must possess a combination of the following skills, and competencies.
Security Information and Events Management (SIEM) Analyst in most cases reports to the Security Operations Center (SOC) Manager since in most cases, they are part of the SOC team. The SOC Manager reports to the Chief Information Security Officer (CISO) of an organization.
To be endorsed as a SIEM analyst, practitioners must acquire certification such as Security+, Certified Ethical Hacker (CEH) by EC Council, Certified Information Systems Security Professional (CISSP) by ISC2, Global Information Assurance Certification (GIAC), CompTIA Advanced Security Practitioner (CASP), Computer Hacking Forensic Investigator (CHFI) by EC-Council among others.