Security Information and Event Management (SIEM) Analyst Job Requirements

The security information and event analyst (SIEM) analyst is responsible for the collection, analysis and validation of all Security information and event management (SIEM) activities that impact the organization either from within the network or outside its network. He/she is responsible for enrollment of information assets (servers, network devices, applications, databases and security solutions) into the SIEM tool for visibility on all security information and events activities within those assets, which are of interest to management and provide insight into attacks or attempts to compromise such organizational computer assets. A SIEM analyst is responsible for the migration of rules, queries and filters that will collect security information and events of interest to production or active database of the SIEM infrastructure while ensuring continuous routine maintenance of security tools and SIEM infrastructure. Security Information and Event Management (SIEM) analyst must be knowledgeable about the different threats and vulnerabilities that confront the organization, their sources and actors. He/she must understand the organization's business and the risk confronting the organization based on the nature of its business. As such, SIEM analyst must be privy to risk assessment, penetration test and vulnerability scan results conducted on all business and information assets of risk significance and the level of controls implemented by management to mitigate such risk. With adequate information of inherent risk, vulnerabilities and threats within the organization's information assets and IT infrastructure, a SIEM analyst would be able to set rules, filters and active monitoring channels to be able to capture security information and events of interest where they occur and by doing so, provide reasonable assurance to the management on the effectiveness of controls implemented to address the risk and plug the vulnerabilities/gaps that could unduly exposure the information assets/infrastructure of the organization to possible compromise.

The SIEM analyst produces and maintain (update) an security incident log that is a reflection of security events or incidents that occurred within the organization's network and IT infrastructure for which the SIEM analyst have visibility on and are reported to management on periodic basis for decision making purpose and as proof that implemented controls are effective and adequate while threats anticipated by the information security and cyber security teams are factored into SIEM infrastructure to give visibility on their occurrence to the SIEM analyst. The SIEM analyst where also acting as the SIEM administrator ensures the optimal running of the SIEM infrastructures and performs functions such as user access management, migration of rules, filters and use cases created by the SIEM analyst, creation and maintenance of active monitoring channels, definition and maintenance of log retention policy in the SIEM infrastructure in line with the organization's data retention policy, backup of the SIEM infrastructure, creation and implementation of flex connectors to capture/read logs of new solutions for which the SIEM's original equipment manufacturer (OEM) does not support, among others. Security information and event management (SIEM) analyst in conjunction with the SIEM administrator (if performed by a different person) are responsible for the tuning and optimization of the SIEM infrastructure to capture relevant/required security information and events of IT infrastructures of interest thereby minimize noise (i.e. irrelevant information and events) that does not have any bearing on the security posture of the organization. Research has shown that optimized SIEM infrastructure improve visibility of the SIEM analyst on critical security information and events that could impact the organization and provide sufficient insight on the attack surface of the organization's IT infrastructure while untuned or unoptimized SIEM infrastructure leads to increased chances of missing out on critical security information and events that could impact the organization or provide insight into the attack surface of the organization's critical IT assets. A SIEM analyst must be experienced and knowledgeable in information security issues as well as SIEM tool being used by his/her organization (e.g. HP Arcsight, IBM Qradar, McAfee SIEM, etc.) and must possess a combination of the following skills, and competencies.

• Understand the information security policies and procedures of the organization.
• Be aware of security baselines of all information and technology assets within the organization.
• Be aware of the standard operating procedures for relevant departments of the organization and operators of IT infrastructure within the organization.
• Working of the various versions of operating systems such as Windows, LINUX and UNIX.
• Good understanding of additional security technologies and equipment such as intrusion prevention system (IPS), intrusion detection system (IDS), public key infrastructure (PKIs), encryption key management, threat analysis, Cisco ASA, Palo Alto, Checkpoint and Juniper SSG, PFSense firewalls and other network devices (e.g. switches and routers), and vulnerability assessment.
• Solid understand of enterprise log management and complex log correlation practices as well as alerting system.
• Project management techniques exposure.
• Work with business and process owners to create correlation rules, filters and use cases specific and relevant to the business.
• Develop, implement, maintain and operate standard content development practices for SIEM infrastructure.
• Collaborate with security operations center (SOC) analysts to optimize the SIEM infrastructure (e.g. HP Arcsight, IBM Qradar, McAfee SIEM, RSA Envision, Splunk, etc.) performance to better serve the needs of the business and create adequate visibility on information assets/infrastructures of interest.
• Forensics investigation and analytical skills.
• Vulnerability Management scans (e.g. NeXpose, Qualys Guard, Nessus, etc.).
• Use of network Analysis tools (e.g. Netwitness, Wireshark, etc.).
• Endpoint security management (e.g. Bit9, Forefront, Carbon Black, Symantec, McAfee, etc.).
• Windows Management (e.g. SCCM, SCOM, Active Directory, WSUS, GPO, etc.).
• File integrity monitoring (FIM), Database Activity Monitoring (DAM), Identity and Access Management (IAM), Internet Policy Enforcement, Web Content Filtering, Data Loss Prevention (DLP) solutions.
• Regulatory frameworks (e.g. PCI, FISMA, NIST, ISO27K, SSAE16, HIPPA, etc.).

Reporting line of a Security Information and Event Management (SIEM) Analyst

Security Information and Events Management (SIEM) Analyst in most cases reports to the Security Operations Center (SOC) Manager since in most cases, they are part of the SOC team. The SOC Manager reports to the Chief Information Security Officer (CISO) of an organization.

Professional Certifications for Security Information and Event Management (SIEM) Analyst

To be endorsed as a SIEM analyst, practitioners must acquire certification such as Security+, Certified Ethical Hacker (CEH) by EC Council, Certified Information Systems Security Professional (CISSP) by ISC2, Global Information Assurance Certification (GIAC), CompTIA Advanced Security Practitioner (CASP), Computer Hacking Forensic Investigator (CHFI) by EC-Council among others.