As a Cyber Security Engineer working in cyber defence team, following were my responsibilities –

• Field extractions, Data normalization for security related events with CIM data models. Specifically worked on user behaviour intelligence logs to identify relevant data models and to normalize the data.
• Writing correlation searches for Threat Detection using Splunk Enterprise Security framework. Making use of ES Threat Intelligence framework to get intelligence feeds and correlating with organisational logs
• Using Risk based framework of Enterprise Security to create Risk Scores on the entities based on activities which poses security risk.
• As part of cloud security initiative, on-boarding of AWS guard duty, security hub, VPC flow, cloudtrail and cloudwatch logs through HEC tokens.
• Data modelling of AWS logs through specific splunk add-ons to map it to CIM data models such as Intrusion Detection, Malware, Authentication, Change etc.
• Writing threat detection queries to catch unusual/malicious activities on AWS logs.
• Installing and configuration of AWS splunk add-ons, dashboards, reports on splunk AWS app.