· Operating and maintaining the current on-premises SIEM platform, including system updates, configuration changes, and hardware service coordination (remotely)

· Performing regular patching and vulnerability mitigation for SIEM infrastructure and auxiliary systems.

· Monitoring and maintaining backup systems and updating detection rules to ensure operational continuity.

· Supporting and maintaining auxiliary systems such as Git servers, rsyslog servers, and other Linux-based services

· Participating in On-Call duty rotations to ensure 24/7 operational support

· Managing approximately 23,000 log sources:

– Ensuring all log sources are active and sending correct data

– Adding new log sources and decommissioning inactive ones

· Verifying data parsing and normalization

· Performing capacity planning and lifecycle management of all components

· Analysing, optimizing, and developing scripts in Python, Bash, or Perl to automate and enhance operations

· Maintaining and improving protocol standards for logging:

– Defining what should be logged

– Testing and rolling out updated standards across the environment

· Coordinating daily operational activities within the SIEM team to ensure smooth execution of tasks and alignment with service expectations

· Acting as a technical escalation point and mentoring junior and mid-level engineers to support their development and ensure knowledge transfer