ArcSight Engineer

Role Summary Experienced ArcSight Engineer to design, implement, configure, administer, and support enterprise SIEM environments using HPE/OpenText ArcSight (ESM, Logger, SmartConnectors). Will work cross-functionally with SOC, security architecture, infrastructure, network, cloud, and customer stakeholders to ensure security events are collected, correlated, monitored, and retained effectively. Key Responsibilities Platform Administration: Install/configure/maintain ArcSight ESM, Logger, SmartConnectors, Connector Appliances, Management Center; manage HA/DR, backups, upgrades, patches, RBAC. Log-Source Onboarding: Onboard Windows, Linux, network, cloud, application, and security log sources; validate event parsing, normalization, and field accuracy. SmartConnector Management: Deploy, tune, and troubleshoot connectors (filters, load balancing, caching, failover, EPS performance). FlexConnector Development: Build custom parsers/regex for unsupported log sources; map fields to ArcSight schema. Correlation & Use-Case Development: Write and tune correlation rules, dashboards, reports, active/session lists; map use cases to threat scenarios and reduce false positives. Logger Administration: Manage storage, retention, indexing, forwarding, and search performance. Monitoring & Troubleshooting: RCA for platform/connector/event issues; support major incidents and on-call rotations. Performance & Capacity Management: Monitor EPS/throughput, tune components, forecast capacity. SOC Support: Assist analysts with investigations, threat hunting, and alert quality improvement. Third-Party Integrations: Firewalls, IDS/IPS, EDR, IAM (AD/Entra ID), cloud (AWS/Azure/GCP), SOAR, ITSM tools via Syslog/REST/JDBC/CEF/SNMP. Change Management: Follow formal change process — implementation/rollback plans, testing, approvals, documentation.