Note: The job is a remote job and is open to candidates in USA. New Era Technology provides end-to-end technology solutions that securely connect people, places, and information. The Senior QRadar Platform Engineer will own the IBM QRadar platform, including administration, infrastructure health, architecture, integrations, roadmap planning, and operational success. The role also provides hands-on troubleshooting, performance optimization, team leadership, mentoring, and technical direction for the SIEM environment.
Responsibilities
- Own the overall health of the QRadar deployment, including all collection devices (event and flow collectors, data gateways, and processors). Proactively identify and remediate current issues affecting log collection and keep the environment stable
- Onboard new log sources and resolve log ingestion issues as they arise — configuring parsing, DSMs, and log source extensions as needed — and validate that events are collected, parsed, and normalized correctly
- Investigate and resolve performance issues affecting critical components. Tune indices, review event/flow pipeline throughput, address EPS/FPM constraints, and optimize the environment so searches and rules run efficiently at scale
- Analyze what's currently being collected and retained, and work with stakeholders to identify data that can be reduced, re-routed, or dropped — trimming noise and storage cost without losing security value
- Build dashboards and reports, and partner with security engineers to optimize the underlying database, searches (AQL), and saved queries for both speed and usefulness
- Apply software patches and updates to keep the system current, secure, and supported
- Onboard new users, manage access, and develop initial training materials to bring the internal team up to speed on the environment
- Own QRadar architecture and infrastructure — including High Availability and Disaster Recovery design, capacity planning, and storage / EPS-FPM growth — to keep the platform scalable, resilient, and aligned to retention and compliance requirements
- Establish and maintain the strategic roadmap for the platform, evaluating new QRadar capabilities, integrations, and modernization opportunities that align with the organization's security objectives
- Lead, mentor, and delegate across the SIEM team — setting technical direction, serving as the top escalation point for complex issues, and staying hands-on to teach and assist wherever needed
- Accountable for platform architecture, operational stability, performance, scalability, and strategic direction of the QRadar ecosystem
- Experience developing and maintaining QRadar standards, operational procedures, and engineering best practices across the organization
- Ability to lead integration efforts across multiple security and infrastructure teams while ensuring data quality and consistency
- Develops proactive monitoring, health-check procedures, and capacity planning processes to ensure platform availability and performance
- Ability to optimize searches and reports for performance and operational efficiency in large-scale environments
- Develops maintenance schedules, operational runbooks, disaster recovery procedures, and platform governance standards
- Ensures adherence to security, compliance, and operational requirements through proper configuration and ongoing system maintenance
- Establishes and maintains the strategic vision and roadmap for the QRadar platform, ensuring alignment with organizational security objectives and future business requirements
- Evaluates new QRadar capabilities, integrations, architecture improvements, and emerging SIEM technologies to recommend platform enhancements
- Leads platform modernization efforts, infrastructure upgrades, scalability initiatives, and long-term planning activities
- Responsible for setting engineering priorities, managing workload distribution, conducting peer reviews, establishing technical standards, and driving operational excellence
- Serves as the highest level of escalation for complex QRadar issues and provides guidance during incident response, troubleshooting, and platform outages
- Provides mentorship, knowledge transfer, and technical training to team members, helping develop organizational expertise and reduce operational risk
- Leads technical problem-solving efforts, facilitates root cause analysis, and ensures lessons learned are incorporated into platform improvements
- Partners closely with Security Operations, Infrastructure, Networking, Identity, Cloud, Application, and Compliance teams to ensure the QRadar platform meets enterprise security monitoring requirements
- Acts as the primary technical point of contact for QRadar-related initiatives, audits, escalations, and strategic projects
- Communicates platform health, risks, roadmaps, and improvement opportunities to leadership and stakeholders
Skills
- 1. Demonstrated hands-on experience as a QRadar engineer or architect operating a production deployment
- 2. Working knowledge of QRadar architecture — Console, Event/Flow Collectors and Processors, Data Nodes, and app host components
- 3. Proven experience onboarding log sources and troubleshooting log collection, parsing, and normalization (DSMs, log source extensions, custom properties)
- 4. Experience diagnosing and resolving QRadar performance issues, including index management and search/pipeline tuning
- 5. Comfort writing and optimizing AQL and building dashboards, saved searches, and reports
- 6. Solid grounding in log management, network protocols, and common log source types (Windows, Linux/syslog, firewalls, cloud, etc.)
- Minimum of 7 years in IT Security; 5 years of QRadar experience
- 1. Demonstrated hands-on experience serving as the primary QRadar engineer, architect, or technical lead supporting large-scale production environments
- 2. Accountable for platform architecture, operational stability, performance, scalability, and strategic direction of the QRadar ecosystem
- 3. Experience developing and maintaining QRadar standards, operational procedures, and engineering best practices across the organization
- 1. Comprehensive understanding of QRadar distributed architectures including Consoles, Event Processors, Event Collectors, Flow Processors, Flow Collectors, Data Nodes, App Hosts, High Availability configurations, and Disaster Recovery architectures
- 2. Ability to design scalable, resilient, and high-performance deployments that meet organizational growth, retention, compliance, and operational requirements
- 3. Experience planning infrastructure capacity, storage utilization, EPS/FPM growth, system expansion, and hardware refresh cycles
- 1. Extensive experience integrating and maintaining a diverse set of log sources including Windows, Linux, Active Directory, Microsoft 365, Azure, AWS, GCP, Palo Alto, Cisco, Check Point, F5, CrowdStrike, EDR/XDR platforms, IDS/IPS, vulnerability scanners, cloud-native security tools, and custom applications
- 2. Advanced proficiency troubleshooting ingestion issues, event parsing, DSM functionality, custom extensions, Universal DSMs, custom properties, log source extensions, protocol configurations, and event normalization
- 3. Ability to lead integration efforts across multiple security and infrastructure teams while ensuring data quality and consistency
- 1. Responsible for ongoing monitoring and maintenance of overall platform health, resource utilization, event processing rates, search performance, storage management, and system stability
- 2. Advanced experience diagnosing and resolving EPS bottlenecks, Ariel database issues, indexing inefficiencies, event pipeline constraints, search latency, application performance concerns, and infrastructure-level issues
- 3. Develops proactive monitoring, health-check procedures, and capacity planning processes to ensure platform availability and performance
- 1. Expert-level knowledge of Ariel Query Language (AQL) including optimization, troubleshooting, and advanced reporting techniques
- 2. Experience creating executive dashboards, SOC operational dashboards, detection metrics, compliance reporting, and custom analytics designed to improve security monitoring capabilities
- 3. Ability to optimize searches and reports for performance and operational efficiency in large-scale environments
- 1. In-depth understanding of network protocols, operating systems, authentication platforms, cloud services, security controls, and common attack methodologies
- 2. Experience correlating data across diverse platforms to support threat detection, incident response, threat hunting, compliance, and operational monitoring requirements
- 3. Ability to evaluate new data sources and determine their value to security operations and business stakeholders
- 1. Serves as the technical owner of the QRadar platform, responsible for all administrative functions including deployment management, patching, upgrades, licensing, certificate management, backup and recovery, user administration, role-based access controls, retention policies, index management, HA configurations, and platform hardening
- 2. Develops maintenance schedules, operational runbooks, disaster recovery procedures, and platform governance standards
- 3. Ensures adherence to security, compliance, and operational requirements through proper configuration and ongoing system maintenance
- 1. Establishes and maintains the strategic vision and roadmap for the QRadar platform, ensuring alignment with organizational security objectives and future business requirements
- 2. Evaluates new QRadar capabilities, integrations, architecture improvements, and emerging SIEM technologies to recommend platform enhancements
- 3. Leads platform modernization efforts, infrastructure upgrades, scalability initiatives, and long-term planning activities
- 1. Proven ability to lead and mentor a team of QRadar engineers, administrators, and analysts
- 2. Responsible for setting engineering priorities, managing workload distribution, conducting peer reviews, establishing technical standards, and driving operational excellence
- 3. Serves as the highest level of escalation for complex QRadar issues and provides guidance during incident response, troubleshooting, and platform outages
- 1. Maintains deep technical proficiency across all areas of QRadar and can independently perform any engineering, administration, architecture, troubleshooting, integration, or upgrade activity within the platform
- 2. Provides mentorship, knowledge transfer, and technical training to team members, helping develop organizational expertise and reduce operational risk
- 3. Leads technical problem-solving efforts, facilitates root cause analysis, and ensures lessons learned are incorporated into platform improvements
- 1. Partners closely with Security Operations, Infrastructure, Networking, Identity, Cloud, Application, and Compliance teams to ensure the QRadar platform meets enterprise security monitoring requirements
- 2. Acts as the primary technical point of contact for QRadar-related initiatives, audits, escalations, and strategic projects
- 3. Communicates platform health, risks, roadmaps, and improvement opportunities to leadership and stakeholders
- English
- Regular use of hands and fingers to operate a computer keyboard, mouse, and other office equipment
- Regular, repetitive movements such as typing, mouse movements, and scrolling
- Ability to hear and understand spoken communications, both in person and via remote communication tools (e.g., phone, video conferencing)
- Ability to see and read computer screens and printed documents, as well as adjust focus. This includes prolonged periods of looking at a computer screen
- 40 hours a week
- None
- Excellent attention to detail
- Strong organizational skills
- Excellent analytical skills
- Excellent documentation skills; demonstrated proficiency in Microsoft Office including Word, Excel and PowerPoint
- Collaborative team worker – both in person and virtually using MS Teams or similar
- Ability to work as liaison between business and information security / information technology
- Excellent interpersonal communication skills with strong spoken and written English
- Solid balance of strategic thinking with detail orientation
- Self-starter, ability to take initiative
- 1. IBM Certified Associate/Deployment Professional for QRadar SIEM
- 2. Experience with QRadar patching, upgrades, and version migrations
- 3. Familiarity with QRadar apps and the App Framework, and with rule/offense tuning
- 4. Prior staff-augmentation or consulting experience stepping into and stabilizing existing environments
- 5. Documentation and knowledge-transfer skills for handing the environment back to an internal team
Benefits
- Access continuous training
Company Overview
Company H1B Sponsorship