What you'll be doing
### Detection Engineering
Design, develop, and maintain high fidelity detections across SIEM, EDR, and cloud platforms
Translate threat intelligence and incident learnings into actionable detection logic based on attacker TTPs mapped to the MITRE ATT&CK; framework
Continuously tune and optimize detections to reduce false positives while maintaining coverage
### Threat Hunting & Validation
Conduct proactive threat hunting activities to identify detection gaps
Validate detections using attack simulation, purple team exercises, or controlled testing
Measure detection coverage and effectiveness against defined KPIs
### Detection as Code & Automation
Manage detection content using version control and Detection as Code principles
Develop automation and tooling (CI/CD pipelines) to support detection lifecycle processes
### Data & Platform Engineering
Work with logging and platform teams to onboard and optimize data sources
Ensure log quality, normalization, and enrichment to support detection use cases
Troubleshoot data or telemetry gaps impacting detection coverage
### Collaboration & Governance
Partner with SOC, Incident Response, and Threat Intelligence teams
Participate in post incident reviews to derive new detection requirements
Maintain documentation, runbooks, and detection design artefacts
Operate within ITSM and change management processes appropriate for a regulated bank
## What we're looking for




### Required
detection engineering or threat detection roles
Understanding of the full detection lifecycle
Strong hands on experience with SIEM platforms (e.g. Splunk, QRadar, Elastic) on developing rules, building dashboards, log parsing.

Advanced proficiency in SPL, AQL, ES|QL query languages
Solid understanding of Windows, Linux, MacOS, Network, Containers and Cloud Security telemetry
Experience in building and maintaining CI/CD pipelines for detection engineering
Scripting experience (Python, Powershell) for automation and detection support
Detection validation using attack simulation
Demonstrated ability to migrate detection logic between SIEM platforms
### Preferred
Exposure to SOAR platforms and response automation
Threat hunting or purple/red team experience
Experience operating in a regulated financial or large enterprise environment
Relevant certifications (e.g. GCDA, GDAT, GCTD, GASAE), GIAC Advisory Board member.
What we offer
Chance to shape detection engineering maturity at enterprise scale
Work on meaningful, attacker driven security problems
Collaboration with senior security professionals across the bank

Detection Engineering across SIEM / EDR / Cloud
Advanced proficiency in Querying & Threat Analytics (SPL, AQL, ES|QL)
Deep knowledge on most common security telemetry (Windows, Linux, MacOS, Containers, Network, Cloud)

📌 CYBER-SEC_IT Software Engineer (Bengaluru)
🏢 TRIGENT SOFTWARE PRIVATE
📍 Bengaluru