Principle LogPoint/GuardSix Consultant
Source Technology Ltd.
Contact person: Sam Bishop
gothenburg, Sweden
ITLog FilesLog Management and IntelligenceArcSight SIEM ToolElastic LogstashSecurity Information and Event ManagementMicrosoft Sentinel
Description
We are supporting our client who is looking for a highly experienced LogPoint / Guardsix SIEM/SOAR Consultant to support a large-scale security and log management programme. The consultant will provide senior technical expertise to establish and further develop the client's Guardsix, formerly LogPoint, environment, with a particular focus on SIEM, SOAR, log management, detection engineering and incident response automation. This is a Level 5 specialist position, requiring someone who can operate with a very high degree of autonomy and take technical ownership of the design, implementation and development of the platform.
Key Responsibilities
• Establish and enhance the core structure, configuration and functionality of the Guardsix/LogPoint platform.
• Integrate and onboard logs and alerts from applications, servers, infrastructure, services and other relevant sources.
• Integrate telemetry from security technologies including EDR and NDR platforms.
• Structure, parse, normalise and enrich security and operational log data.
• Develop and implement SIEM use cases, correlation rules, alert rules and detection logic.
• Design and implement SOAR playbooks, automated actions and standardised incident response workflows.
• Develop dashboards, operational views and security visualisations.
• Establish processes for monitoring log flow, data quality and ingestion health.
• Test and validate integrations, detections, alerts, automated actions and playbooks.
• Develop frameworks and working practices for the ongoing development and quality assurance of SIEM detections.
• Produce detailed technical documentation covering configurations, integrations, workflows and solutions.
• Provide technical guidance and knowledge transfer to internal security and technology teams.
• Establish a sustainable foundation that enables the client to continue developing and managing the Guardsix environment independently. Mandatory
Experience Candidates must be able to demonstrate:
• Level 5 / Principal-level expertise, typically associated with approximately 10+ years of relevant senior technical experience or specialist expertise.
• Minimum 5 years' experience with Guardsix / LogPoint.
• Minimum 5 years' experience implementing and deploying large-scale enterprise log management solutions.
• Experience working in complex organisations with multiple departments, business units or subsidiaries and significant system dependencies.
• Minimum 3 years' experience with SIEM technology, ideally specifically Guardsix/LogPoint.
• Minimum 1 year of SOAR experience, ideally specifically within Guardsix/LogPoint.
• Strong practical experience with enterprise log-source onboarding, integration, parsing, normalisation and enrichment.
• Strong detection engineering experience, including SIEM use cases, correlation rules, alerts and detection logic.
• Experience creating SOAR playbooks and security automation workflows.
• Experience integrating SIEM platforms with wider security tooling, particularly EDR and NDR.
• Experience designing operational security dashboards and visualisations.
• Strong documentation and knowledge-transfer capabilities.
• Ability to operate independently and take technical ownership of a complex SIEM/SOAR environment.
Highly Desirable The strongest candidates will offer:
• 10+ years' experience implementing enterprise log management solutions.
• 10+ years' documented Guardsix/LogPoint experience.
• 5+ years specifically working with Guardsix/LogPoint SIEM.
• 3+ years working with Guardsix/LogPoint SOAR.
• Previous responsibility as a Principal Consultant, Lead SIEM Engineer, SIEM Architect, Security Architect or LogPoint SME.
• Experience leading major SIEM/SOAR transformations or implementations within complex enterprise or public-sector environments.