SME - Security Analysis, SIEM

Pune, Maharashtra

Job Summary

Serve as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving Customer security detection content. • Translate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics. • Work with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise. • Design and develop correlation searches, risk-based alerts, dashboards, analytic stories, reports, and investigation searches in Splunk. • Maintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement. • Map detections to MITRE ATT&CK; techniques, Client threat scenarios, control objectives, and relevant assets or business services. • Analyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes. • Support security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics. • Validate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection. • Maintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics. • Automate detection deployment, testing, version control, and content quality checks where feasible. • Mentor L2 analysts and provide technical reviews for detection-content changes.

Key Responsibilities

Serve as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving Customer security detection content. • Translate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics. • Work with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise. • Design and develop correlation searches, risk-based alerts, dashboards,



analytic stories, reports, and investigation searches in Splunk. • Maintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement. • Map detections to MITRE ATT&CK; techniques, Client threat scenarios, control objectives, and relevant assets or business services. • Analyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes. • Support security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics. • Validate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection. • Maintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics. • Automate detection deployment, testing, version control, and content quality checks where feasible. • Mentor L2 analysts and provide technical reviews for detection-content changes.

Skill Requirements

Expert-level Splunk Search Processing Language, correlation searches, Enterprise Security, risk-based alerting, data models, CIM, macros, lookups, accelerated searches, and dashboards. • Solid experience with Splunk Cloud and enterprise-scale security content engineering. • Experience onboarding and validating telemetry from endpoint, identity, PAM, cloud, network, email, application, database, and security-control platforms. • Deep knowledge of MITRE ATT&CK;, threat detection methodologies, attacker behavior, cyber kill chain, and common detection frameworks. • Experience with detection-as-code, Git, CI/CD, unit testing, content validation, Python, REST APIs, and automation. • Ability to analyze data quality, field normalization,



sourcetypes, index strategy, parsing, latency, and ingestion reliability. • Experience integrating threat intelligence, asset context, identity context, vulnerability data, and business criticality into detections. • Understanding of SOC workflows, incident response, threat hunting, false-positive management, and detection-performance metrics. • Knowledge of Sigma, YARA, KQL, EQL, or other detection languages is preferred. Soft Skills

Other Requirements

Serve as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving Customer security detection content. \\r\\n• Translate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics. \\r\\n• Work with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise. \\r\\n• Design and develop correlation searches, risk-based alerts, dashboards, analytic stories, reports, and investigation searches in Splunk. \\r\\n• Maintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement. \\r\\n• Map detections to MITRE ATT&CK; techniques, Client threat scenarios, control objectives, and relevant assets or business services. \\r\\n• Analyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes. \\r\\n• Support security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics. \\r\\n• Validate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection. \\r\\n• Maintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics. \\r\\n• Automate detection deployment, testing, version control, and content quality checks where feasible. \\r\\n• Mentor L2 analysts and provide technical reviews for detection-content changes. \\r\\n

📌 SME - Security Analysis, SIEM (India)
🏢 HCLTech
📍 India