– Senior SIEM Engineer

Location: Gurugram

Experience: 5–8 Years (Minimum 4 Years in SIEM Engineering)

Role Overview

We are looking for a Senior SIEM Engineer with strong hands-on experience in SIEM platform administration, log integration, parsing, detection engineering, and performance optimization within an enterprise SOC/MSSP workplace.

Key Responsibilities

- Administer, maintain, and optimize enterprise SIEM platforms.
- Onboard log sources and develop custom parsers, field extraction, and log normalization.
- Develop, tune, and optimize correlation rules, detection use cases, and threat-hunting queries aligned with MITRE ATT&CK.;
- Create searches, dashboards, and reports while reducing false positives.
- Monitor SIEM health, event processing, indexing, storage, and system performance.
- Troubleshoot production issues, support upgrades, patching, and critical incidents.
- Integrate security logs from firewalls, IDS/IPS, EDR, Windows/Linux, cloud, applications, and identity platforms.
- Ensure log collection using Syslog, CEF, LEEF, JSON, XML, and custom formats.
- Support automation, SOAR integrations, documentation, and continuous service improvement.

Required Technical Skills
- SIEM Engineering: Platform administration, log onboarding, parsing,



normalization, event correlation, and troubleshooting.
- Detection Engineering: Correlation rules, use-case development, rule tuning, threat hunting, and MITRE ATT&CK.;
- Platform Management: Health monitoring, performance optimization, indexing, storage, upgrades, and capacity planning.
- Security Technologies: Firewalls, IDS/IPS, EDR, Windows/Linux, Active Directory, network devices, and cloud security.
- Networking & Logs: TCP/IP, DNS, HTTP/HTTPS, Syslog, authentication protocols, CEF, LEEF, JSON, and XML.
- Automation: Python, PowerShell, or Shell scripting; REST APIs and SOAR integrations are preferred.
- Cloud & Threat Intelligence: AWS/Azure/GCP/OCI and threat intelligence integrations are an advantage.

Experience & Qualifications
- 5–8 years in cybersecurity, including at least 4 years in SIEM or security platform engineering.
- Hands-on experience in enterprise SOC/MSSP environments, preferably supporting 24×7 operations.
- Strong troubleshooting, analytical, documentation, and client communication skills.
- SIEM vendor certifications or Security+, CySA+, GCIH, GCIA, or equivalent certifications are preferred.

📌 SEIM ENGINEER (Security Information and Event Management) (Gurugram)
🏢 Incedo
📍 Gurugram