Job Description
– Senior SIEM Engineer

Location:
Gurugram

Experience:
5–8 Years (Minimum 4 Years in SIEM Engineering) Role Overview We are looking for a Senior SIEM Engineer with robust hands-on experience in SIEM platform administration, log integration, parsing, detection engineering, and performance optimization within an enterprise SOC/MSSP environment.

Key Responsibilities
• Administer, maintain, and optimize enterprise SIEM platforms.
• Onboard log sources and develop custom parsers, field extraction, and log normalization.
• Develop, tune, and optimize correlation rules, detection use cases, and threat-hunting queries aligned with MITRE ATT&CK.;
• Create searches, dashboards, and reports while reducing false positives.
• Monitor SIEM health, event processing, indexing, storage, and system performance.
• Troubleshoot production issues, support upgrades, patching, and critical incidents.
• Integrate security logs from firewalls, IDS/IPS, EDR, Windows/Linux, cloud, applications, and identity platforms.
• Ensure log collection using Syslog, CEF, LEEF, JSON, XML, and custom formats.
• Support automation, SOAR integrations, documentation, and continuous service improvement. Required Technical Skills
• SIEM Engineering: Platform administration,



log onboarding, parsing, normalization, event correlation, and troubleshooting.
• Detection Engineering: Correlation rules, use-case development, rule tuning, threat hunting, and MITRE ATT&CK.;
• Platform Management: Health monitoring, performance optimization, indexing, storage, upgrades, and capacity planning.
• Security Technologies: Firewalls, IDS/IPS, EDR, Windows/Linux, Active Directory, network devices, and cloud security.
• Networking & Logs: TCP/IP, DNS, HTTP/HTTPS, Syslog, authentication protocols, CEF, LEEF, JSON, and XML.
• Automation: Python, PowerShell, or Shell scripting; REST APIs and SOAR integrations are preferred.
• Cloud & Threat Intelligence: AWS/Azure/GCP/OCI and threat intelligence integrations are an advantage. Experience & Qualifications
• 5–8 years in cybersecurity, including at least 4 years in SIEM or security platform engineering.
• Hands-on experience in enterprise SOC/MSSP environments, preferably supporting 24×7 operations.
• Strong troubleshooting, analytical, documentation, and client communication skills.
• SIEM vendor certifications or Security+, CySA+, GCIH, GCIA, or equivalent certifications are preferred.

📌 SEIM ENGINEER (Gurugram)
🏢 Incedo
📍 Gurugram