Meet the Team:

The Incident Detection and Response (ID&R) team provides visibility into security and compliance, performs incident response, and drives root cause analysis to improve Cisco’s security posture.

ID&R serves Cisco and its business entities to detect, respond, and mitigate security incidents, improve compliance and security posture, as well as ensure Cisco meets its regulatory and contractual obligations for data loss notification​.

Responsibilities Include:

• Splunk Domain Expert

• Learn and deploy new technologies as needed to support business objectives related to security detection and response.

• Update, modify, and enhance existing programs used for security detection and response.

• Lead software upgrades, evaluations of new versions of the software.

• Maintain the production security environment, including identification of problems and driving resolution.

• Maintain data availability as a part of a 24x7 duty rotation.

• Develop documentation on all custom solutions.

Desired Skills

• Splunk Administration (minimum 4 years of experience)

• Splunk Enterprise Security configuration and tuning

• Splunk Cloud Administration

• Splunk SOAR

• Search Head Clustering

• Indexer Clustering

• Onboarding new data sources

• Patching, configuration, and maintenance

• Ability to automate recovery of frequent operational issues

• Administration of other SIEMs (ELK, ExaBeam, etc) is a plus

• Cloud platforms (AWS, GCP, Azure)

• Experience deploying in AWS (AMI, CloudFormation, etc.)

• Excellent communication skills and a self-starter

• Using GitHub repositories

• Jira Service Desk, ServiceNow for issue tracking and resolution

• Experience with Linux/UNIX systems and the standard methodologies for deploying applications to those stacks.

• Experience writing in Python (Perl also useful)

• Web services and APIs in RESTful and SOAP

• Agility and willingness to deal with a high level of ambiguity and change

• Flexibility – willingness to pitch in where needed across program and team

• Global teaming skills and ability to focus the team to deliver to timelines

• Ability to multi-task

Certifications

• Splunk Cloud Certified Administrator (required)

• Splunk Enterprise Certified Architect (preferred)

• AWS Certified Solutions Architect (preferred)

Why Cisco? 

At Cisco, we’re revolutionizing how data and infrastructure connect and protect organizations in the AI era – and beyond. We’ve been innovating fearlessly for 40 years to create solutions that power how humans and technology work together across the physical and digital worlds. These solutions provide customers with unparalleled security, visibility, and insights across the entire digital footprint.

Fueled by the depth and breadth of our technology, we experiment and create meaningful solutions. Add to that our worldwide network of doers and experts, and you’ll see that the opportunities to grow and build are limitless. We work as a team, collaborating with empathy to make really big things happen on a global scale. Because our solutions are everywhere, our impact is everywhere. 

We are Cisco, and our power starts with you.