Role: SIEM Engineer (5-8 Years Experience)

Experience

5-8 Years

Location Bangalore

Role Summary

We are seeking a skilled SIEM Engineer with 5-8 years of experience in designing, implementing, and maintaining Security Information and Event Management (SIEM) platforms. The ideal candidate will be responsible for building and managing centralized logging and threat detection infrastructure, ensuring reliable log collection, data normalization, correlation rule development, and platform performance optimization.

The role bridges backend system architecture and cybersecurity operations by enabling real-time threat detection, monitoring, and incident investigation through scalable and resilient SIEM solutions.

Key Responsibilities

SIEM Platform Engineering & Administration

- Design, deploy, configure, and maintain enterprise SIEM platforms such as Microsoft Sentinel, Splunk Enterprise Security, QRadar, LogRhythm, ArcSight, Elastic SIEM, or FortiSIEM.
- Ensure high availability, scalability, and performance of SIEM infrastructure.
- Monitor SIEM health, storage utilization, data retention, and system performance.
- Perform platform upgrades, patch management, and troubleshooting.

Log Management & Data Integration

- Design and manage log ingestion pipelines from various sources including:
- Servers (Windows/Linux)
- Network devices
- Firewalls
- IDS/IPS
- Endpoint security tools
- Cloud platforms (Azure, AWS, GCP)
- Applications and databases

- Develop and maintain parsers, collectors, connectors, and agents.
- Ensure proper log normalization, enrichment, and categorization for effective security analytics.




- Optimize log collection to reduce noise while ensuring compliance requirements are met.

Detection Engineering

- Develop, tune, and maintain correlation rules, alerts, and use cases.
- Create threat detection content aligned with MITRE ATT&CK; framework.
- Enhance detection capabilities by integrating threat intelligence feeds.
- Reduce false positives through continuous tuning and optimization.

Security Monitoring & Incident Support

- Support SOC teams in investigating security incidents and alerts.
- Conduct log analysis and forensic investigations when required.
- Assist in threat hunting activities using SIEM and security analytics tools.
- Provide technical expertise during incident response engagements.

Automation & Integration

- Integrate SIEM with security tools such as:
- EDR/XDR platforms
- Vulnerability management solutions
- SOAR platforms
- Threat Intelligence Platforms (TIP)

- Automate repetitive operational tasks using scripting and APIs.
- Develop dashboards, reports, and visualizations for security monitoring.

Governance & Compliance Support

- Support compliance requirements related to logging and monitoring standards.
- Ensure log retention aligns with regulatory and organizational requirements.
- Assist with audit requests and security reporting activities.





Required Technical Skills

SIEM Technologies

- Hands-on experience with one or more SIEM solutions:
- Microsoft Sentinel
- Splunk
- IBM QRadar
- ArcSight
- LogRhythm
- Elastic SIEM
- FortiSIEM

Operating Systems

- Windows Server Administration
- Linux Administration

Log Management & Analytics

- Syslog
- Windows Event Logs
- Audit Logs
- Log Parsing and Normalization
- Event Correlation

Security Technologies

- Firewalls
- IDS/IPS
- Endpoint Detection & Response (EDR)
- Network Security Monitoring
- IAM/Active Directory
- Cloud Security Monitoring

Scripting & Automation

- Python
- PowerShell
- Bash/Shell Scripting
- REST APIs

Cloud Platforms

- Microsoft Azure
- AWS
- Google Cloud Platform (Preferred)

Security Frameworks

- MITRE ATT&CK;
- Cyber Kill Chain
- NIST Cybersecurity Framework
- ISO 27001

Required Qualifications

- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or related field.
- 5-8 years of experience in SIEM Engineering, Security Monitoring, or Security Operations.
- Experience in enterprise-scale log management and security event monitoring environments.
- Solid understanding of security operations and incident response processes.
- Knowledge of network protocols, system architecture, and cybersecurity fundamentals.

Preferred Certifications

- Microsoft Certified: Security Operations Analyst (SC-200)
- IBM QRadar Certified Associate
- CompTIA Security+
- GIAC Certified Incident Handler (GCIH)
- Certified SOC Analyst (CSA)
- Microsoft Azure Security Engineer (AZ-500)

📌 TEST MODULE LEAD - Azure Sentinel SIEM (Bengaluru)
🏢 Happiest Minds Technologies
📍 Bengaluru