The Security Engineer is responsible for the implementation, administration, and tuning of security tools and platforms, including the SIEM (like Splunk). When a Security Analyst requires additional data sources to be onboarded or needs correlation rules to be created or modified for better detection, this is a technical implementation task. The request is escalated to the Security Engineer, who has the necessary access, skills, and responsibility to manage the security infrastructure, ingest new data, and develop or refine detection logic. This division of duties allows analysts to focus on monitoring and investigation while engineers focus on maintaining and improving the tools.

A. SOC Manager: This role is responsible for overall SOC strategy, personnel management, and operational oversight, not the hands-on technical implementation of rules or data onboarding.

B. Security Analyst: This is the role that identifies the need and initiates the request; they do not typically have the permissions or responsibility to implement platform-level changes.

D. Security Architect: This role focuses on the high-level design and strategic planning of the security infrastructure, rather than the day-to-day operational tasks of rule creation and data integration.

---

1. Splunk Whitepaper

"Building a Security Operations Center": This document outlines typical SOC roles. It defines the Security Engineer as the role responsible for managing security tools. Their duties explicitly include "maintaining the SIEM

handling data ingestion

and creating new rules for detection." This directly maps to the tasks described in the question. (See page 6

"Key SOC Roles").

2. NIST Special Publication 800-181 Rev. 1

"Workforce Framework for Cybersecurity (NICE Framework)": This standard defines cybersecurity work roles. The Cyber Defense Analyst (AN-TWA-001) "Uses defensive measures and information collected...to identify...events." The Cyber Defense Infrastructure Support Specialist (OM-INF-001) "Tests

implements

deploys

maintains

and administers the infrastructure hardware and software." The analyst's request for more information (data sources

rules) would be fulfilled by the infrastructure support role

which is analogous to a Security Engineer.

3. Splunk Enterprise Security Documentation

"Administer Splunk Enterprise Security": The documentation on creating and modifying correlation searches specifies that a user must have the essadmin role

which has the editcorrelationsearches capability. This administrative role is typically assigned to a Security Engineer or SIEM administrator

not a standard Security Analyst. (See section: "Configure correlation searches in Splunk ES").