Job Title: SIEM Content Developer

Location: Bangalore, KA (WFO)

Skills Required: Content Developer

Experience: 4-7 Years

: Minimum 4+ years of experience

- Use Case Development: Knowledge of organizational risks and threats to design relevant and effective detection rules.
- Log Sources: Understanding log formats, sources, and parsing for accurate data utilization in use cases.
- SIEM and Analytics Tools: Familiarity with platforms like Securonix, Sentinel, or Splunk to implement and monitor use cases.
- Alert Logic: Ability to define thresholds, logic, and conditions to reduce false positives and improve detection accuracy.
- Incident Response Needs: Awareness of incident response workflows to align use cases with actionable intelligence.
- Performance Metrics: Skills to create and optimize KPI/KRI reports to track detection and response performance.
- Fine-Tuning Methodology: Experience in analyzing alert data to refine use cases and adjust logic periodically. Detect and respond to company-wide security incidents, coordinating cross-functional teams to mitigate and eradicate threats.
- Incident response lead to high impact cyber security incidents
- Triage events, escalations and incidents to determine remediation and resolution actions
- Coordinate appropriate response activities across teams or directly with stakeholders to rapidly remediate potential threats
- Develop playbooks to improve processes and information sharing across teams
- Initiative and project-related support to provide Security Operations and Incident Response perspective and subject matter expertise
- Contribute technical and process improvements within the team
- Participate in current operations, on call rotation. Which includes some after-hours responsibilities and escalations.

Desired Skills:(Good to Have)





- EC-Councils Certified Incident Handler (E|CIH)
- Experience with Cloud Computing and technology
- Experience with Unix/Linux, or work relating to OS internals or file level forensics
- CISSP or related GIAC certifications

Essential Skills: (Must Have)

- Experience in Cyber Threat incident response, vulnerability research, malware analysis and exploit investigation.
- Demonstrated experience in computer security related disciplines, including but not limited to the following subject areas: software vulnerabilities and exploitation, host forensics, malware analysis, network traffic analysis, Insider Threat and web-focused security topics.
- Knowledgeable about up-to-date security related subjects and trends, for example, Advanced Persistent Threat (APT), Spear Phishing, and credential compromise techniques
- Proven ability to drive large scale, high visibility projects with high collaboration and leadership
- Excellent judgment, decision making skills, and the ability to work under pressure
- Excellent written and oral communication skills
- Excellent presentation skills and experience of presenting to senior management
- Solid understanding of events, related fields in log records and alerts reported by various data sources such as Windows/Unix systems, IDS/IPS, AV, HIDS/HIPS, WAFs, firewalls, and web proxies
- Develop and improve the existing EDR Specific usecases for enhanced detection.
- Analyze the TTP's of the emerging threats and co-ordinate with the EDR team to develop use cases at EDR.
- Closely co-ordinate and provide continuous support for CSIRT team in an event of a P1/P2 Security Incidents.
- Conduct a Security Incident tabletop simulation internally within SOC to gauge the process and track improvements.
- Handle BEC emails targeted against VIP users within the Organization

📌 SIEM content development (Sikandrabad)
🏢 Tekskills
📍 Sikandrabad