Senior QRadar Platform Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of the overall health and stability of the IBM QRadar deployment, which includes collection devices, data gateways, and processors.

• Onboard new log sources while addressing ingestion, parsing, DSM, log source extension, and normalization challenges.

• Investigate and troubleshoot performance issues; optimize indices, event/flow throughput, EPS/FPM constraints, searches, and rules.

• Analyze retained data to minimize, reroute, or eliminate unnecessary information while maintaining security value.

• Create dashboards and reports while optimizing AQL, database queries, and saved searches.

• Apply software patches and updates as required.

• Onboard users, manage access permissions, and develop training materials.

• Own the architecture and infrastructure of QRadar, including High Availability (HA), Disaster Recovery (DR), capacity planning, storage, and EPS/FPM growth.

• Establish and uphold the QRadar strategic roadmap, evaluating capabilities, integrations, and modernization opportunities.

• Lead, mentor, and delegate tasks within the SIEM team; set technical direction and act as an escalation point.

• Collaborate with Security Operations, Infrastructure, Networking, Identity, Cloud, Application, and Compliance teams.

• Communicate platform health, risks, roadmaps, and opportunities for improvement to leadership and stakeholders.

• Report directly to the Engagement Manager.

• Engage in a staff augmentation assignment expected to last 3 months, with the possibility of month-to-month renewal.

⛳️ Requirements

• At least 7 years of experience in IT Security.

• Minimum of 5 years working with QRadar.

• Hands-on experience as a QRadar engineer or architect managing a production deployment.

• Proficient understanding of QRadar architecture, including Console, Event/Flow Collectors and Processors, Data Nodes, and App Host components.

• Experience onboarding log sources and troubleshooting issues related to log collection, parsing, and normalization, including DSMs, log source extensions, and custom properties.

• Skilled in diagnosing and resolving QRadar performance challenges, including index management and search/pipeline tuning.

• Proficient in writing and optimizing AQL, as well as creating dashboards, saved searches, and reports.

• Knowledgeable in log management, network protocols, and common log source types, such as Windows, Linux/syslog, firewalls, and cloud services.

• Understanding of QRadar distributed architectures, High Availability, and Disaster Recovery principles.

• Experience in planning for capacity, storage utilization, EPS/FPM growth, system expansion, and hardware refresh cycles.

• Familiarity with integrating log sources including Windows, Linux, Active Directory, Microsoft 365, Azure, AWS, GCP, Palo Alto, Cisco, Check Point, F5, CrowdStrike, EDR/XDR, IDS/IPS, vulnerability scanners, cloud-native security tools, and custom applications.

• Knowledge of network protocols, operating systems, authentication platforms, cloud services, security controls, and common attack methodologies.

• Experience with QRadar administration and lifecycle management, including patching, upgrades, licensing, certificate management, backup and recovery, user administration, RBAC, retention policies, index management, HA, and platform hardening.

• Ability to lead and mentor QRadar engineers, administrators, and analysts.

• Excellent documentation skills and proficiency in Microsoft Office, including Word, Excel, and PowerPoint.

• Strong verbal and written communication skills in English.

• Capability to serve as a liaison between business and information security/information technology.

• Regular ability to operate computer equipment and engage in prolonged screen-based work.

• Required education: None.

• Preferred qualifications include IBM Certified Associate/Deployment Professional for QRadar SIEM; experience with QRadar patching, upgrades, and version migrations; knowledge of QRadar apps/App Framework and rule/offense tuning; staff-augmentation or consulting experience; and skills in documentation and knowledge transfer.

🏝️ Benefits

• Competitive benefits package.

• Opportunities for continuous training.

• Personal and professional development opportunities.

• Equal employment opportunities for all applicants.

• Reasonable accommodations provided for individuals with disabilities.