Senior Technical Specialist Job In Dublin

Senior Technical Specialist (Detection Engineer) Job Description

We are seeking an experienced Senior Technical Specialist (Detection Engineer) to join our Endpoint Security Team as a Subject Matter Expert, focusing on SIEM management, Log source onboarding, and continuous improvement of security monitoring coverage and capabilities.

Key Responsibilities:

• Build new detection capabilities based upon research, analysis of threat actor methodologies, and testing of new attack techniques for cloud-based platforms in Azure, AWS, GCP, and other SaaS providers.
• Serve as a Subject Matter Expert (SME) for SIEM management, log source onboarding, and SIEM platform optimisation.
• Design, deploy, and maintain SIEM agents/systems across the environment to meet Service Level Agreements (SLAs) and operational requirements.
• Onboard and integrate new log sources into SIEM, ensuring compliance with organisational security policies and regulatory requirements.
• Contribute to development and implementation of use cases and correlation rules to detect and respond to security incidents.
• Perform periodic audits and health checks of SIEM infrastructure, including performance tuning, system upgrades, and patch management.
• Collaborate with cross-functional teams to ensure successful integration of log sources from various network devices, application, and security tools.
• Participate in incident detection and response activities, acting as a key member of the Critical Incident Response Team during major incidents.
• Proactively identify opportunities to automate, optimise, and enhance the SIEM platform and overall security operations.
• Actively work with our threat operations and engineering team to enhance the processes that support the SOC team's mission.
• Mentor junior engineers and provide training on SIEM technologies and security event management practices.
• Production of quality documentation and training material.
• Ensure adherence with risk management programmes.
• Security Infrastructure Capacity Planning & Management for the SIEM service.
• Attend project meetings and maintain strong relationships.
• Identify opportunities or emerging demands and plan for them.
• Ensure that business risks are identified, and adequate controls are in place.
• Ensure alignment with industry best practices, compliance standards, and frameworks such as ISO 27001, NIST, GDPR, MITRE ATT&CK framework, and more.

Requirements:

• Third-level qualification in Information Security or IT, or equivalent work or education-related experience preferable.
• Ideally five years' experience in an IT Security industry role and ten plus years' experience in the IT industry.
• Previous experience in one or more of the following: Host, Network, or Cloud Intrusion Detection, Cloud Security Research, Cloud Security Operations (Cloud Sec Ops) in AWS, GCP, Microsoft Azure, Kubernetes/Docker, and/or SaaS services.
• In-depth experience with popular SIEM platforms such as Trellix SIEM, Microsoft Sentinel, Splunk, QRadar, etc.
• Experience creating and optimising detections for cloud environments.
• Programming/Scripting experience (Python, Java Script, Power Shell, etc.).
• Ability to Design, build, and implement components of the technical infrastructure using an advanced and in-depth knowledge of the technology and be a resource for other technologists, Architects, and CSS management.
• Advanced technical troubleshooting skills, particularly in the Windows environment.
• Experience with failover clusters, disaster recovery, backup & restore, patching, and server hardening.
• Owns the resolution of incidents and problems.
• Acts as lead technologist.
• Runs meetings/workshops to drive out problems, etc.
• Ensures that solutions arrived at are comprehensive and of high quality.
• Provides direction and leadership.
• Have an ability to identify key influencers and build strong relationships with them.
• Provides leadership to and advises, coaches, and mentors less senior staff.
• Knowledge of information security and risk control frameworks such as COBIT, ISO 27001, ISO 27002, GDPR, OWASP.
• Industry-recognised certifications desired such as Security+, Certified Information Systems Security Professional (CISSP), SIEM-specific certifications (e.g., Splunk Certified Admin, QRadar Specialist), SAN's certificates, etc.

About Us:

Canada Life Group is the top-level European holding company for the Great-West Lifeco Group's European insurance, reinsurance, and asset management companies, with business operations in the UK, Ireland, Germany, and the Isle of Man.

European Technology sits within Canada Life Group and encompasses the technology community across all European entities, Irish Life Group, Canada Life UK, Canada Life Europe, and Central Technology Services.

European Technology supports the business strategy and collaboration of technology across all European divisions.

Central Technology Services (CTS) provides IT infrastructure and security operations services to Europe.

We are an Equal Opportunities employer and celebrate diversity of thought and perspective.