Administer and maintain log servers including upgrades, patching, and migrations. Design and implement high availability and clustering solutions for log servers.
Manage log archiving, retention policies, and backup strategies. Onboard new log sources from cloud platforms, applications, network devices, and endpoints.
Perform log parsing, normalization, and selective event ingestion to optimize SIEM performance. Configure streaming and forwarding mechanisms for real-time log delivery.
Develop scripts (e.g., Python, Shell) for log processing, automation, and system tasks. Utilize APIs for log collection, integration, and automation workflows.
Create dashboards, reports, and configure alerts for log ingestion health and security insights. Monitor data quality and ingestion anomalies, ensuring completeness and accuracy.
Work closely with SOC, IR, and infrastructure teams to align log management with security ope...