Key Responsibilities

- Perform SIEM onboarding, configuration, administration, monitoring, and troubleshooting across various security and infrastructure platforms.

- Integrate and onboard new log sources into the SIEM, including configuration, parsing, normalization, validation, and troubleshooting.

- Develop, implement, test, and maintain security detection rules, correlation rules, and SIEM use cases based on organizational security requirements and emerging threats.

- Perform SIEM fine-tuning and optimization to reduce false positives, improve detection accuracy, and enhance platform performance.

- Monitor, triage, investigate, and respond to security alerts and incidents across SIEM, EDR, email security, IAM, and other security tools.

- Handle EDR and email security incidents, including alert investigation, containment, escalation, remediation support, and post-incident analysis.

- Design and implement security automation workflows to automate repetitive SOC activities, alert enrichment, investigation, response, and remediation tasks.

- Develop and maintain SOAR playbooks, workflows, and integrations to improve incident response efficiency and reduce manual intervention.

- Integrate SIEM, SOAR, EDR, threat intelligence, IAM, email security, ticketing systems, and other security tools to enable automated security operations.

- Automate alert enrichment, IOC lookups, threat intelligence correlation, user/entity investigation, notification, and response actions.

- Develop and maintain scripts and custom security tools using Python, PowerShell, Bash, or similar scripting languages to support Security Operations.





- Configure and maintain security ticket management workflows, ensuring security alerts and incidents are properly tracked, assigned, prioritized, escalated, and closed.

- Manage the complete security incident ticket lifecycle, including ticket creation, categorization, prioritization, assignment, SLA tracking, escalation, documentation, and closure.

- Integrate SIEM/SOAR platforms with ITSM/ticketing solutions to automate ticket creation, updates, assignment, and closure.

- Ensure accurate and timely documentation of incident investigation, evidence, actions taken, root cause, and resolution.

- Support IAM security activities, including monitoring authentication and access-related events and identifying suspicious identity-related activity.

- Troubleshoot issues related to SIEM data ingestion, log collection, connectors, parsing, event normalization, detection rules, and integrations.

- Collaborate with SOC, infrastructure, cloud, network, application, IAM, and other technology teams to improve security visibility and response capabilities.

- Continuously assess and improve detection coverage, automation opportunities, SOAR playbooks, and SOC operational processes.

- Maintain documentation for SIEM integrations, detection use cases, automation workflows, SOAR playbooks, troubleshooting procedures,



and operational processes.

- Participate in continuous improvement initiatives to enhance SOC efficiency, detection capabilities, incident response, and security operations maturity.

Required Skills & Experience

- Hands-on experience with SIEM platforms, including onboarding, administration, troubleshooting, and fine-tuning.

- Strong understanding of detection engineering, correlation rules, use cases, and threat detection methodologies.

- Experience with SIEM log source integration, parsing, normalization, and troubleshooting.

- Hands-on experience with EDR and email security platforms.

- Experience in security incident monitoring, investigation, triage, and response.

- Strong understanding of SOAR concepts, playbook development, workflow automation, and security orchestration.

- Experience developing security automation and custom tools for SOC/Security Operations.

- Scripting experience with Python, PowerShell, Bash, or similar languages.

- Experience with ticket management / ITSM platforms and security incident lifecycle management.

- Understanding of IAM and identity security concepts, including authentication, authorization, privileged access, and identity monitoring.

- Experience integrating security platforms with SIEM, SOAR, EDR, IAM, threat intelligence, email security, and ticketing systems.

- Strong analytical and troubleshooting skills with the ability to investigate complex security events.

- Valuable communication, documentation, collaboration, and incident-management skills.

Pay: ₹25,000.00 - ₹30,000.00 per month

Work Location: In person

📌 SOC Engineer (Chennai)
🏢 Necurity Solutions
📍 Chennai