Sr. Specialist CSOC Onboarding and tools

Deploy and maintain SIEM, SOAR, and other security platforms in an enterprise environment. - Engineer scalable security architectures leveraging cloud-native and data-lake-based analytics. - Integrate security tools across endpoints, email, identity, network, and cloud workloads. - Optimize log ingestion, normalization, enrichment, and cost management. - Develop and maintain basic dashboards, alerts, and queries to support threat detection. - Troubleshoot issues related to data ingestion, performance, and integrations as part of the platform monitoring. Essential Requirements:

Advanced training/certification on Security tools like Sentinel, XDR, DLP. - SANS certifications (for security analyst/SIEM). - Cloud Security Engineering certification (Azure/AWS). - 4+ years of work experience with good general security knowledge. - Strong knowledge of security tools, especially Sentinel and M365 Defender. - Experience in configuring data collection endpoints, connectors, and parsers. Working at Novartis means being part of a mission to improve and extend peoples lives, striving to become the most valued and trusted medicines company in the world. Novartis is committed to building an outstanding, inclusive work environment and diverse teams. If you are ready to collaborate, support, and create breakthroughs, join Novartis and be a part of shaping a brighter future together. As an Onboarding & AI Engineering at Novartis, you will play a vital role in designing, developing, implementing, and managing dataflow pipelines to integrate them with SIEM platforms such as Sentinel. The data onboarded to SIEM will be crucial for CSOC Analysts, content development, and SOAR Engineers to develop monitoring alerts and automation playbooks. Your collaboration with internal and external stakeholders will be essential, including Novartis' internal teams, external vendors, and Product/Platform engineers. Working closely with Application owners, you will integrate various datasources using services like Cribl, Syslog NG, Azure Monitoring Agent, Universal Forwarder, and Azure Functions. Key Responsibilities:

Evaluate and onboard new data sources, perform data analysis for identifying anomalies and trends, and develop dashboards and visualizations for data reporting. - Collaborate with CSOC engineers, Threat Hunters, and CSOC Analysts to gather requirements and develop solutions. - Troubleshoot and provide support for onboarding issues with platforms like Sentinel and Cribl. - Validate and ensure proper configuration and implementation of new logics with security system and application owners. - Perform data normalization, establish datasets, and develop data models. - Manage backlog of customer requests for onboarding new data sources. - Detect and resolve issues in various data sources, implement health monitoring for data sources and feeds, and identify opportunities for automation in data onboarding. - Provide 24x7 on-call support on a rotational basis, including weekends, to ensure system stability and incident response readiness. Cybertools Responsibilities:

Deploy and maintain SIEM, SOAR, and other security platforms in an enterprise environment. - Engineer scalable security architectures leveraging cloud-native and data-lake-based analytics.