11 Aug
|
Important Business
|
Chennai
11 Aug
Important Business
Chennai
Duties & Responsibilities
- Engineer and maintain SIEM ingestion pipelines, including data connectors, parsers, normalization, and enrichment across endpoint, network, cloud, identity, and app telemetry sources.
- Build, tune, and update detection rules, correlation logic, and analytics aligned to MITRE ATT&CK;, threat intelligence, and evolving TTPs.
- Operate and enhance Cribl Stream and Cribl Edge pipelines for log routing, transformation, filtering, enrichment, and delivery optimization.
- Support onboarding of recent log sources, including schema mapping, troubleshooting ingestion failures, and validating data quality and completeness.
- Assist in reducing false positives and improving signaltonoise through SIEM tuning, enrichment enhancements, and Cribl workflow adjustments.
- Develop queries, dashboards, and data models used by SOC and IR teams for investigations, monitoring, and hunting.
- Monitor telemetry ingestion metrics, SIEM health, license usage,
and Cribl pipeline performance; identify and resolve operational issues.
- Perform investigation support by validating detections, analyzing telemetry gaps, and implementing fixes to improve future coverage.
- Mentor junior analysts and engineers on SIEM query languages (KQL/SPL), detection development, logging best practices, and Cribl pipeline fundamentals.
- Maintain SIEM and telemetry documentation including data dictionaries, ingestion maps, detection catalogs, and engineering runbooks.