ArcSight Engineer

As a cybersecurity professional with over 3 years of hands-on experience, I specialize in ArcSight SIEM solutions, particularly in custom parser (FlexConnector) development, log integration, and event correlation. My expertise lies in designing robust, scalable, and efficient log ingestion pipelines that transform raw data into actionable security intelligence.   My core skill set includes:   ArcSight FlexConnector Development: I have developed numerous custom parsers using both Regex and XML FlexConnectors for integrating non-standard log sources into ArcSight. My parsers ensure accurate parsing, normalization, categorization, and mapping of security events across complex environments.   Log Source Onboarding: I’ve successfully onboarded log sources such as custom applications, Linux/Windows systems, firewalls, and cloud services by tailoring connectors to specific requirements and ensuring data is mapped to ArcSight’s Common Event Format (CEF).   SmartConnector & Logger Administration: I am experienced in deploying and managing SmartConnectors, fine-tuning their performance, and troubleshooting issues related to EPS, parsing errors, and device miscommunication.   Event Correlation & Content Creation: Beyond ingestion, I design correlation rules, active channels, dashboards, reports, and filters that enable Security Operations Center (SOC) teams to quickly detect and respond to security incidents.   SIEM Use Case Development: I’ve collaborated with SOC teams to gather requirements and implement custom use cases, aligned with MITRE ATT&CK and compliance standards like ISO 27001 and GDPR.   Regex Mastery: My deep knowledge of regular expressions allows me to extract structured data from complex, multi-line logs with high precision, a critical skill for FlexConnector development.   Automation & Scripting: Proficient in PowerShell, Python, and Bash scripting for automating connector monitoring, log rotation, and health checks.   I have worked in enterprise environments where security is paramount, including financial services, telecommunications, and public sector projects. These experiences have taught me the importance of clean documentation, change control, and secure deployment practices.   What sets me apart is my ability to analyze unknown log formats, reverse-engineer proprietary data structures, and turn them into reliable, real-time event feeds in ArcSight. I take pride in writing parsers that are not only functional but also optimized for long-term maintainability and minimal performance impact.   I am a proactive communicator and collaborator, always ready to join agile teams or work independently. Whether you’re building a new SIEM infrastructure, expanding log coverage, or fine-tuning your existing deployment, I bring both the technical depth and operational awareness needed for success.   Let’s connect if you’re looking for a reliable ArcSight engineer who can deliver precise, well-documented, and security-focused parser solutions.