Role Summary

Seeking an experienced security professional with strong expertise in SIEM, SOAR (XDR), IAM and DLP platforms. The candidate should possess hands-on experience in SIEM implementation, administration, content engineering, threat hunting, incident response, and SOC optimization across multiple SIEM technologies such as Microsoft Sentinel, ArcSight or similar platforms. Manage digital identities, access controls, authentication, authorization and identity lifecycle processes while ensuring compliance with organizational security policies and regulatory requirements.

Key Responsibilities

Lead investigations for complex security incidents through all stages: identification, containment, eradication, recovery, and lessons learned. Design, implement, optimize SIEM and Security deployments, own our Data Loss Prevention program end to end, build out our Insider Risk and UEBA capabilities, and contribute to incident response, endpoint security, VPN, vulnerability management, data leak protection and third-party risk management (TPRM) and advanced threats.

Support end-to-end SIEM implementation including onboarding log sources, parsing, normalization, and data pipelines. Support continuous improvement by translating incident learnings into better detections, dashboards, and playbooks.

Build and tune detection rules, correlation logic, dashboards, alerts, and threat hunting content.

Develop and manage our Insider Risk Management process (IRM), identify risk signals early in the pipeline.

Familiarity with UEBA concepts and the ability to correlate signals from SaaS platforms, endpoints, and email security tools to identify and investigate risky user behavior.





Develop and maintain SOAR playbooks, automation workflows, and integrations.

Perform threat hunting, malware analysis, and root cause investigations.

Provide technical guidance to junior analysts and lead incident response activities.

Participate in SOC transformation, SIEM migrations, and platform evaluations.

Design, implement and support enterprise Identity and Access Management (IAM) solutions.

Manage the complete identity lifecycle, including Joiner, Mover, and Leaver processes.

Implement automated user provisioning and de-provisioning across enterprise applications.

Manage user identities, accounts, roles, groups, and access entitlements.

Implement and maintain Role-Based Access Control (RBAC) & Attribute Based Access Control (ABAC) and other access models.

Manage access requests, approvals, and entitlement assignments. Conduct periodic access reviews and access certifications. Implement and manage Segregation of Duties (SoD) controls and identify access conflicts.

Configure and manage Microsoft Purview DLP policies across enterprise environments.

Identify, classify, and protect sensitive and confidential organizational data. Develop and maintain DLP policies, rules, conditions, and exceptions based on business and security requirements.

Configure DLP controls across Microsoft 365, Exchange Online,



SharePoint, OneDrive, Teams and Endpoints. Configure and manage Sensitive Information Types (SITs) and detection mechanisms. Implement and maintain Microsoft Purview sensitivity labels and data classification controls.

Develop technical documentation, policy documentation, procedures and operational runbooks.

Required Technical Skills

Strong hands-on experience in implementing or managing SIEM platforms such as Microsoft Sentinel, ArcSight or equivalent along with IAM & DLP solutions.

Hands-on experience in SOAR implementation and automation orchestration.

Knowledge of MITRE ATT&CK;, Cyber Kill Chain, IOC analysis, and threat intelligence.

Understanding of EDR/XDR, NDR, Email Security, IAM, DLP and Security Controls integration.

Hands-on experience with Microsoft Purview DLP. Strong understanding of data classification and information protection. Developing and implementing DLP policies and controls, a robust understanding of sensitive data identification and classification.

Experience configuring Sensitive Information Types (SITs).

Developing DLP policy exceptions and exclusions.

Knowledge of GRC principles, data classification frameworks, and regulatory requirements.

Knowledge of Microsoft Entra ID and Microsoft 365 security architecture.

Experience with data classification standards and the ability to translate policies into technical controls.

Familiarity with security frameworks and any applicable regulations.

Experience

6-8 years of experience in Information Security, with a focus on SIEM, Data Protection (DLP) & Identity Access management (IAM).

📌 IT Security Analyst (Bella Vista)
🏢 Manvision Consulting
📍 Bella Vista