Role Overview :We are looking for a Senior SIEM Engineer with strong hands-on experience in SIEM platform administration, log integration, parsing, detection engineering, and performance optimization within an enterprise SOC/MSSP setting.Key Responsibilities :- Administer, maintain, and optimize enterprise SIEM platforms.- Onboard log sources and develop custom parsers, field extraction, and log normalization.- Develop, tune, and optimize correlation rules, detection use cases, and threat-hunting queries aligned with MITRE ATT&CK.-; Create searches, dashboards, and reports while reducing false positives.- Monitor SIEM health, event processing, indexing, storage, and system performance.- Troubleshoot production issues, support upgrades, patching, and critical incidents.- Integrate security logs from firewalls, IDS/IPS, EDR, Windows/Linux, cloud, applications, and identity platforms.- Ensure log collection using Syslog, CEF, LEEF, JSON, XML, and custom formats.- Support automation, SOAR integrations, documentation, and continuous service improvement.Required Technical Skills:- SIEM Engineering: Platform administration, log onboarding, parsing, normalization, event correlation,



and troubleshooting.- Detection Engineering: Correlation rules, use-case development, rule tuning, threat hunting, and MITRE ATT&CK.-; Platform Management: Health monitoring, performance optimization, indexing, storage, upgrades, and capacity planning.- Security Technologies: Firewalls, IDS/IPS, EDR, Windows/Linux, Active Directory, network devices, and cloud security.- Networking & Logs: TCP/IP, DNS, Syslog, authentication protocols, CEF, LEEF, JSON, and XML.- Automation: Python, PowerShell, or Shell scripting; REST APIs and SOAR integrations are preferred.- Cloud & Threat Intelligence: AWS/Azure/GCP/OCI and threat intelligence integrations are an advantage.Experience & Qualifications :- 5 - 8 years in cybersecurity, including at least 4 years in SIEM or security platform engineering.- Hands-on experience in enterprise SOC/MSSP environments, preferably supporting 24x7 operations.- Strong troubleshooting, analytical, documentation, and client communication skills.- SIEM vendor certifications or Security+, CySA+, GCIH, GCIA, or equivalent certifications are preferred. (ref:hirist.tech)

📌 Senior Information and Cyber Security Consultant - AWS (Gurugram)
🏢 Incedo Technology Solutions
📍 Gurugram