Level 3 Support Engineer

INCIDENT RESPONSE & DIGITAL FORENSICS PLATFORMPositionLevel 3 Support EngineerLocationRemoteEmployment typeFull-time,Working hoursStandard business hours & on-call requirement.ABOUT THE ROLE

We build and deliver an incident response case management and digital forensics platform. Customers use it to run investigations end to end: opening a case, uploading triage packages, parsing raw artifacts into structured records, enriching data and detecting indicators of compromise, hunting across indexed evidence, and producing publish-ready incident reports.

The platform is deployed on-premise as a containerized stack — a web UI, a Python API backend, a reverse proxy, a cache and message broker, asynchronous task workers, a search and indexing engine, and a relational database, orchestrated with Docker Compose. Because it runs inside the customer's own environment, this role sits at the deepest point of technical resolution before an issue reaches engineering.

Our customers run their own first- and second-line support, so issues arrive already triaged. What reaches you is what their teams could not solve — deep platform behaviour, parsing failures, performance problems, and defects. You will own these end to end: reproducing them, reading logs across containers, tracing failures through the stack, and either resolving them directly or handing engineering a fully diagnosed defect.

Support is the priority. When there is no active ticket queue, your secondary focus is developing recent artifact parsers in Python — extending what the platform can ingest and making the next round of investigations faster.

KEY RESPONSIBILITIES

Escalation Support (Primary)

- Act as the technical owner for issues escalated by customer support teams and platform administrators, driving each to resolution within agreed service levels.
- Diagnose failures across the full stack: API errors, asynchronous task failures, queue and broker behaviour, search indexing and query problems, database issues, and proxy or certificate misconfiguration.
- Troubleshoot triage package processing — investigate failed file-and-parser pairs, unsupported formats, parser exceptions, and stalled or queued jobs.
- Resolve search and threat-hunting issues, including query syntax, filter definitions, missing or mis-mapped records, and search performance on large datasets.




- Support report generation problems: template errors, asynchronous jobs that never complete, and incorrect output in PDF or DOCX exports.

Level 3 Support Engineer | Page of
- Handle configuration and administration issues across users and roles, permissions, threat intelligence feeds, enrichers, IOC detection, automation rules and actions, and workflow automation.
- Reproduce defects in a lab environment and escalate to engineering with clear reproduction steps, logs, evidence, and a root cause hypothesis.
- Track every issue to closure in the ticketing system and communicate status to customers in clear, non-defensive language.

Deployment, Upgrades, and Onboarding

- Run new customer deployments: validate hardware and operating system prerequisites, configure environment variables, size search-engine memory correctly for the host, apply product keys and licenses, and bring the stack up cleanly.
- Perform version upgrades, including data backup, restore, and database schema migration steps, with a tested rollback path.
- Advise customers on hardware sizing appropriate to their ingestion volume and hunting workload.
- Validate deployments after installation and hand over to the customer with fully documented configuration.

Parser Development (Secondary — When the Support Queue Allows)

- Develop new parsers in Python that convert raw forensic artifacts into structured, searchable records.
- Register parsers on the platform and define artifact identification criteria so the correct files route to the correct parser.
- Implement the parser interface and map extracted output to the platform's normalized schema for indexing.
- Extend or fix existing parsers based on real failures observed in customer tickets.
- Test parsers against representative sample data and document their coverage and known limitations.

Enablement and Knowledge

- Write and maintain knowledge base articles, troubleshooting runbooks,



and playbooks so customer teams can resolve recurring issues themselves instead of escalating them.
- Deliver training and onboarding sessions to customer analysts and administrators, covering case management, triage processing, threat hunting, and reporting.
- Design and build automation workflows for customers — mapping their operational process into nodes, conditions, schedulers, and approval steps.
- Feed recurring pain points back to product and engineering as structured improvement input.

REQUIRED QUALIFICATIONS

- 4+ years in technical support, digital forensics and incident response, security operations, or a similar hands-on role, with at least two years handling deep escalations rather than front-line triage.
- Strong Python — able to read unfamiliar code, debug it, and write production-quality parsing scripts independently.
- Solid Linux administration, particularly Ubuntu: shell, service management, networking, storage, permissions, and log analysis.
- Practical Docker and Docker Compose skills: inspecting containers, reading service logs, diagnosing startup failures, and managing multi-container stacks.

Level 3 Support Engineer | Page of
- Working knowledge of a search and indexing engine such as Elasticsearch — indices, mappings, query syntax, and common performance problems.
- Understanding of digital forensic artifacts and what they represent — Windows event logs, the master file table and file system metadata, registry hives, and system or application logs.
- Comfortable with REST APIs and reading structured data formats including JSON and YAML.
- Genuine customer-facing skill — able to explain a technical root cause to a non-technical stakeholder and stay calm during a live incident.
- Clear written English. Documentation quality is part of the job, not an afterthought.

PREFERRED QUALIFICATIONS

- Hands-on incident response or forensic investigation experience, whether in-house, at a managed security service provider, or in consulting.
- Production experience with task queues, in-memory data stores, relational databases, or reverse proxies.
- Experience building or maintaining log parsers, data normalization pipelines, or SIEM ingestion rules.
- Exposure to workflow automation or security orchestration tooling.
- Prior experience supporting an on-premise product deployed into customer-controlled environments.

📌 Level 3 Support Engineer (India)
🏢 Clarigo Infotech Private
📍 India