Job Summary Division: Cybersecurity- AppSec Track SOC- Detection Engineering

Level: L3

Location: Offshore (India)

Years of Experience: 10 years of experience in SIEM engineering, Splunk content development, detection engineering, SOC analytics, or threat-detection use cases.

Responsibilities

- Serve as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving customer security detection content.
- Translate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics.
- Work with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise.
- Design and develop correlation searches, risk-based alerts, dashboards, analytic stories, reports, and investigation searches in Splunk.
- Maintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement.
- Map detections to MITRE ATT&CK; techniques, client threat scenarios, control objectives, and relevant assets or business services.
- Analyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes.
- Support security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics.
- Validate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection.
- Maintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics.
- Automate detection deployment, testing, version control, and content quality checks where feasible.
- Mentor L2 analysts and provide technical reviews for detection-content changes.

Technical Requirements

- Expert-level Splunk Search Processing Language, correlation searches, Enterprise Security, risk-based alerting, data models, CIM, macros, lookups, accelerated searches, and dashboards.
- Strong experience with Splunk Cloud and enterprise-scale security content engineering.
- Experience onboarding and validating telemetry from endpoint, identity, PAM, cloud, network, email, application, database, and security-control platforms.
- Deep knowledge of MITRE ATT&CK;, threat detection methodologies, attacker behavior, cyber kill chain, and common detection frameworks.
- Experience with detection-as-code, Git, CI/CD, unit testing, content validation, Python, REST APIs, and automation.
- Ability to analyze data quality, field normalization, sourcetypes, index strategy, parsing, latency, and ingestion reliability.
- Experience integrating threat intelligence, asset context, identity context, vulnerability data, and business criticality into detections.
- Understanding of SOC workflows, incident response, threat hunting, false-positive management, and detection-performance metrics.
- Knowledge of Sigma, YARA, KQL, EQL, or other detection languages is preferred.

Soft Skills

- Excellent communication and presentation skills.
- Strong problem-solving and critical thinking skills.
- Exceptional project management and organizational abilities.
- Team collaboration and leadership skills.
- Client-focused approach with a commitment to delivering exceptional customer service.

Certifications (Good to have) Good to have relevant certificates like (any of the below):

- Splunk Enterprise Security Certified Admin, Splunk Cloud Certified Admin, or Splunk Enterprise Certified Admin.
- GCIA, GCIH, GMON, CISSP, CySA , or equivalent detection/security-operations certification is preferred.

Educational Qualifications

- University degree in IT or/and IT Security.
- Bachelor's degree in computer science/IT or any relevant fields.

Key Responsibilities Division: Cybersecurity- AppSec Track SOC- Detection Engineering

Level: L3

Location: Offshore (India)

Years of Experience: 10 years of experience in SIEM engineering, Splunk content development, detection engineering, SOC analytics, or threat-detection use cases.

Responsibilities

- Serve as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving customer security detection content.
- Translate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics.
- Work with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise.
- Design and develop correlation searches, risk-based alerts, dashboards, analytic stories, reports, and investigation searches in Splunk.
- Maintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement.
- Map detections to MITRE ATT&CK; techniques, client threat scenarios, control objectives, and relevant assets or business services.
- Analyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes.




- Support security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics.
- Validate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection.
- Maintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics.
- Automate detection deployment, testing, version control, and content quality checks where feasible.
- Mentor L2 analysts and provide technical reviews for detection-content changes.

Technical Requirements

- Expert-level Splunk Search Processing Language, correlation searches, Enterprise Security, risk-based alerting, data models, CIM, macros, lookups, accelerated searches, and dashboards.
- Strong experience with Splunk Cloud and enterprise-scale security content engineering.
- Experience onboarding and validating telemetry from endpoint, identity, PAM, cloud, network, email, application, database, and security-control platforms.
- Deep knowledge of MITRE ATT&CK;, threat detection methodologies, attacker behavior, cyber kill chain, and common detection frameworks.
- Experience with detection-as-code, Git, CI/CD, unit testing, content validation, Python, REST APIs, and automation.
- Ability to analyze data quality, field normalization, sourcetypes, index strategy, parsing, latency, and ingestion reliability.
- Experience integrating threat intelligence, asset context, identity context, vulnerability data, and business criticality into detections.
- Understanding of SOC workflows, incident response, threat hunting, false-positive management, and detection-performance metrics.
- Knowledge of Sigma, YARA, KQL, EQL, or other detection languages is preferred.

Soft Skills

- Excellent communication and presentation skills.
- Strong problem-solving and critical thinking skills.
- Exceptional project management and organizational abilities.
- Team collaboration and leadership skills.
- Client-focused approach with a commitment to delivering exceptional customer service.

Certifications (Good to have) Good to have relevant certificates like (any of the below):

- Splunk Enterprise Security Certified Admin, Splunk Cloud Certified Admin, or Splunk Enterprise Certified Admin.
- GCIA, GCIH, GMON, CISSP, CySA , or equivalent detection/security-operations certification is preferred.

Educational Qualifications

- University degree in IT or/and IT Security.
- Bachelor's degree in computer science/IT or any relevant fields.

Skill Requirements Division: Cybersecurity- AppSec Track SOC- Detection Engineering

Level: L3

Location: Offshore (India)

Years of Experience: 10 years of experience in SIEM engineering, Splunk content development, detection engineering, SOC analytics, or threat-detection use cases.

Responsibilities

- Serve as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving customer security detection content.
- Translate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics.
- Work with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise.
- Design and develop correlation searches, risk-based alerts, dashboards, analytic stories, reports, and investigation searches in Splunk.
- Maintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement.
- Map detections to MITRE ATT&CK; techniques, client threat scenarios, control objectives, and relevant assets or business services.
- Analyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes.
- Support security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics.
- Validate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection.
- Maintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics.
- Automate detection deployment, testing, version control, and content quality checks where feasible.
- Mentor L2 analysts and provide technical reviews for detection-content changes.

Technical Requirements

- Expert-level Splunk Search Processing Language, correlation searches, Enterprise Security, risk-based alerting, data models, CIM, macros, lookups, accelerated searches, and dashboards.
- Strong experience with Splunk Cloud and enterprise-scale security content engineering.
- Experience onboarding and validating telemetry from endpoint, identity, PAM, cloud, network, email, application, database, and security-control platforms.
- Deep knowledge of MITRE ATT&CK;, threat detection methodologies, attacker behavior,



cyber kill chain, and common detection frameworks.
- Experience with detection-as-code, Git, CI/CD, unit testing, content validation, Python, REST APIs, and automation.
- Ability to analyze data quality, field normalization, sourcetypes, index strategy, parsing, latency, and ingestion reliability.
- Experience integrating threat intelligence, asset context, identity context, vulnerability data, and business criticality into detections.
- Understanding of SOC workflows, incident response, threat hunting, false-positive management, and detection-performance metrics.
- Knowledge of Sigma, YARA, KQL, EQL, or other detection languages is preferred.

Soft Skills

- Excellent communication and presentation skills.
- Strong problem-solving and critical thinking skills.
- Exceptional project management and organizational abilities.
- Team collaboration and leadership skills.
- Client-focused approach with a commitment to delivering exceptional customer service.

Certifications (Positive to have) Good to have relevant certificates like (any of the below):

- Splunk Enterprise Security Certified Admin, Splunk Cloud Certified Admin, or Splunk Enterprise Certified Admin.
- GCIA, GCIH, GMON, CISSP, CySA , or equivalent detection/security-operations certification is preferred.

Educational Qualifications

- University degree in IT or/and IT Security.
- Bachelor's degree in computer science/IT or any relevant fields.

Other Requirements Division: Cybersecurity- AppSec Track SOC- Detection Engineering

Level: L3

Location: Offshore (India)

Years of Experience: 10 years of experience in SIEM engineering, Splunk content development, detection engineering, SOC analytics, or threat-detection use cases.

Responsibilities

- Serve as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving customer security detection content.
- Translate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics.
- Work with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise.
- Design and develop correlation searches, risk-based alerts, dashboards, analytic stories, reports, and investigation searches in Splunk.
- Maintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement.
- Map detections to MITRE ATT&CK; techniques, client threat scenarios, control objectives, and relevant assets or business services.
- Analyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes.
- Support security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics.
- Validate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection.
- Maintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics.
- Automate detection deployment, testing, version control, and content quality checks where feasible.
- Mentor L2 analysts and provide technical reviews for detection-content changes.

Technical Requirements

- Expert-level Splunk Search Processing Language, correlation searches, Enterprise Security, risk-based alerting, data models, CIM, macros, lookups, accelerated searches, and dashboards.
- Strong experience with Splunk Cloud and enterprise-scale security content engineering.
- Experience onboarding and validating telemetry from endpoint, identity, PAM, cloud, network, email, application, database, and security-control platforms.
- Deep knowledge of MITRE ATT&CK;, threat detection methodologies, attacker behavior, cyber kill chain, and common detection frameworks.
- Experience with detection-as-code, Git, CI/CD, unit testing, content validation, Python, REST APIs, and automation.
- Ability to analyze data quality, field normalization, sourcetypes, index strategy, parsing, latency, and ingestion reliability.
- Experience integrating threat intelligence, asset context, identity context, vulnerability data, and business criticality into detections.
- Understanding of SOC workflows, incident response, threat hunting, false-positive management, and detection-performance metrics.
- Knowledge of Sigma, YARA, KQL, EQL, or other detection languages is preferred.

Soft Skills

- Excellent communication and presentation skills.
- Robust problem-solving and critical thinking skills.
- Exceptional project management and organizational abilities.
- Team collaboration and leadership skills.
- Client-focused approach with a commitment to delivering exceptional customer service.

Certifications (Good to have) Good to have relevant certificates like (any of the below):

- Splunk Enterprise Security Certified Admin, Splunk Cloud Certified Admin, or Splunk Enterprise Certified Admin.
- GCIA, GCIH, GMON, CISSP, CySA , or equivalent detection/security-operations certification is preferred.

Educational Qualifications

- University degree in IT or/and IT Security.
- Bachelor's degree in computer science/IT or any relevant fields.

📌 SME - Security Analysis, SIEM (India)
🏢 HCL Technologies
📍 India