Roles and Responsibilities

- Architect, implement, and maintain SIEM infrastructure to ensure reliable log ingestion, parsing, correlation, and alerting across enterprise systems.

- Develop and fine-tune detection content and analytics rules to identify suspicious or malicious activity across endpoints, networks, and cloud environments.

- Manage and enhance Network Detection and Response (NDR) and Extended Detection and Response (XDR) platforms, integrating telemetry for end-to-end visibility.

- Partner with the SOC and Incident Response teams to improve alert fidelity, reduce false positives, and accelerate investigation workflows.

- Integrate SIEM with SOAR and automation pipelines to support rapid response and consistent case handling.

- Collaborate with infrastructure and application teams to ensure comprehensive log coverage and compliance with data retention and privacy requirements.

- Develop and maintain dashboards, metrics, and reporting to measure detection performance and operational efficiency.

- Conduct periodic health checks, tuning, and performance optimization for SIEM and NDR solutions.

- Maintain detailed documentation, playbooks, and SOPs supporting SIEM and NDR operations.

Skills and Qualifications

Required

- 58 years of experience in security engineering, detection engineering, or SOC architecture in an enterprise environment.

- Expert-level knowledge of SIEM platforms (e.g., Splunk, XSOAR, or equivalent), including onboarding, parsing, rule creation, and optimization.

- Robust understanding of detection engineering, including attack chain mapping, MITRE ATT&CK; coverage, and event correlation.

- Experience with log source onboarding (firewalls, proxies, endpoints, cloud, identity, email systems etc.).





- Familiarity with SOAR tools and automation workflows for triage and enrichment.

- Strong scripting skills (Python, PowerShell, or Bash) for rule automation, parsing, and enrichment.

- Understanding of cloud detection engineering across Azure, AWS, or GCP environments.

- Excellent analytical, problem-solving, and communication skills, with a focus on collaboration and data-driven decision-making.

- SIEM engineering and administration (Splunk, Sentinel, etc.)

- Log collection, parsing, and correlation logic development

- NDR/XDR deployment and tuning (e.g., ExtraHop, Vectra, Cisco, CrowdStrike, or similar)

- Detection engineering and content lifecycle management

- Cloud detection coverage (Azure, AWS, GCP)

- Scripting and automation (Python, PowerShell, Bash)

- SOAR integration for alert enrichment and response automation

- Data normalization, threat hunting, and query development

- Familiarity with the MITRE ATT&CK; and D3FEND frameworks

- Network security, endpoint telemetry, and identity-based detection techniques

Preferred

- Bachelor’s degree in Cybersecurity, Computer Science, or related technical field, or equivalent professional experience.

- Demonstrated success designing, scaling, and maintaining enterprise SIEM and detection systems.

- Certifications such as GIAC Certified Detection Analyst (GCDA), GIAC Security Operations Certified (GSOC), CompTIA CySA+, ISC2 SSCP, Splunk Enterprise Security Certified Admin or Architect, or equivalent detection engineering or SIEM certification

- Analytical and detail-oriented with a focus on precision and reliability

- Solid communication and collaboration across technical and non-technical stakeholders

- Adaptable and proactive in a fast-paced, global environment

- Passion for continuous learning, innovation, and automation in security operations

- Effective mentor and team contributor

📌 Sr IT Security Analyst SIEM SOAR (Hyderabad)
🏢 TechnoGen
📍 Hyderabad