Company Overview Milestone Technologies is a global IT managed services firm that partners with organizations to scale their technology, infrastructure and services to drive specific business outcomes such as digital transformation, innovation, and operational agility. Milestone is focused on building an employee-first, performance-based culture and for over 25 years, we have a demonstrated history of supporting category-defining enterprise clients that are growing ahead of the market. The company specializes in providing solutions across Application Services and Consulting, Digital Product Engineering, Digital Workplace Services, Private Cloud Services, AI/Automation, and ServiceNow. Milestone culture is built to provide a collaborative, inclusive environment that supports employees and empowers them to reach their full potential. Our seasoned professionals deliver services based on Milestone’s best practices and service delivery framework. By leveraging our vast knowledge base to execute initiatives, we deliver both short-term and long-term value to our clients and apply continuous service improvement to deliver transformational benefits to IT. With Intelligent Automation, Milestone helps businesses further accelerate their IT transformation. The result is a sharper focus on business objectives and a dramatic improvement in employee productivity. Through our key technology partnerships and our people-first approach, Milestone continues to deliver industry-leading innovation to our clients. With more than 3,000 employees serving over 200 companies worldwide, we are following our mission of revolutionizing the way IT is deployed. Job Overview We are looking for Senior SIEM Engineer to support a client’s Next Generation Security Event Management program. The client is migrating SIEM capability from IBM QRadar to Elastic Security Stack and needs experienced engineers to support data-source onboarding, Elastic ingestion, ECS normalization, and detection logic development. Role Summary The Senior SIEM Engineer will be responsible for onboarding and operationalizing prioritized security telemetry into Elastic Security, including creation and maintenance of data streams, ingest pipelines, index templates, field mappings, ECS normalization, and detection rules. The role requires strong hands-on experience in Elastic SIEM engineering, security log ingestion, parsing, detection engineering, and working with SOC/security monitoring teams.

Key Responsibilities
• Assess security log sources for onboarding readiness, including connectivity, log format, volume, collection method, parsing needs, data quality, field availability, and detection suitability.
• Design, configure, test, and maintain Elastic data streams, index templates, component templates, mappings, naming conventions, lifecycle policies, and retention settings.
• Develop and maintain Elastic ingest pipelines to parse, enrich, transform, and normalize security events.
• Map source fields to Elastic Common Schema (ECS) or approved security data models.
• Validate end-to-end telemetry ingestion into Elastic,



including timestamp accuracy, parsing success, field extraction, mapping conflicts, duplicate events, data loss, and pipeline failures.
• Design, develop, test, tune, and deploy detection rules and security use cases in Elastic Security.
• Build detection logic using KQL, EQL, ES|QL, threshold rules, correlation logic, exceptions, risk scoring, and rule metadata.
• Map detections to relevant MITRE ATT&CK; tactics, techniques, and sub-techniques.
• Document detection logic, test evidence, tuning decisions, false-positive considerations, known limitations, and production-readiness recommendations.
• Troubleshoot ingestion, parsing, ECS mapping, indexing, alerting, detection, and performance issues across Elasticsearch and Kibana.
• Partner with SIEM Engineering, SOC, Threat Intelligence, application owners, source-system owners, and third-party teams such as Cribl.
• Maintain technical documentation, runbooks, implementation evidence, deployment records, risks, dependencies, and operational handover artifacts.
• Provide regular status updates on progress, blockers, risks, dependencies, and decisions required. Required Skills And Experience
• 7+ years in cybersecurity / SIEM engineering, with at least 3+ years of hands-on Elastic Security / Elasticsearch / Kibana experience preferred.
• Strong hands-on experience as a SIEM Engineer / Detection Engineer / Security Data Engineer.
• Practical experience with Elastic Security / Elastic SIEM / Elasticsearch / Kibana.
• Experience creating and maintaining data streams, ingest pipelines, mappings, index templates, and lifecycle configurations.
• Strong knowledge of security log ingestion, parsing, enrichment, transformation, and normalization.
• Experience with Elastic Common Schema (ECS) mapping and data-model alignment.
• Hands-on experience writing detection rules using KQL, EQL, ES|QL, threshold logic, and correlation logic.
• Good understanding of SOC operations, alert triage, incident detection, and security monitoring use cases.
• Experience mapping detections to MITRE ATT&CK.;
• Ability to troubleshoot log ingestion, parsing, indexing, pipeline, and alerting issues.
• Strong documentation skills, including runbooks, design notes, validation evidence, and operational handover documents.
• Ability to work independently with multiple technical stakeholders and source-system owners. Good to Have
• Experience with IBM QRadar to Elastic migration.
• Experience with Cribl for log routing, transformation, and enrichment.
• Experience with cloud, endpoint, identity, network, firewall, application, and infrastructure log sources.




• Familiarity with change-management and production deployment processes in enterprise environments.
• Experience in regulated or large enterprise environments. Tools / Technologies
• Elastic Security
• Elasticsearch
• Kibana
• Elastic Ingest Pipelines
• Elastic Common Schema
• KQL / EQL / ES|QL
• MITRE ATT&CK;
• Cribl
• IBM QRadar
• Jira / Confluence or similar tracking and documentation tools Expected Profile
• Senior-level SIEM professional with robust hands-on Elastic engineering experience.
• Must be comfortable with both data engineering for security telemetry and detection engineering.
• Should be proactive, documentation-focused, and able to coordinate across SOC, security engineering, application, infrastructure, and vendor teams. Compensation Estimated Pay Range: Exact compensation and offers of employment are dependent on circumstances of each case and will be determined based on job-related knowledge, skills, experience, licenses or certifications, and location. Our Commitment to Diversity & Inclusion At Milestone we strive to create a workplace that reflects the communities we serve and work with, where we all feel empowered to bring our full, authentic selves to work. We know creating a diverse and inclusive culture that champions equity and belonging is not only the right thing to do for our employees but is also critical to our continued success. Milestone Technologies provides equal employment opportunity for all applicants and employees. All qualified applicants will receive consideration for employment and will not be discriminated against on the basis of race, color, religion, gender, gender identity, marital status, age, disability, veteran status, sexual orientation, national origin, or any other category protected by applicable federal and state law, or local ordinance. Milestone also makes reasonable accommodations for disabled applicants and employees. We welcome the unique background, culture, experiences, knowledge, innovation, self-expression and perspectives you can bring to our global community. Our recruitment team is looking forward to meeting you. *Notice to Job Seekers Regarding Impersonation and Fraudulent Job Offers* It has come to our attention that unauthorized individuals and entities are impersonating Milestone Technologies, Inc. on various job boards/portals, specifically Naukri.com and Linkedin.com Please be advised of the following official Milestone Technologies recruitment policies: Official Communication Channels All legitimate email communications from our recruitment team will originate ONLY from the domains: @milestone.tech. We do not use generic email services (e.g. @gmail.com, @yahoo.com, @outlook.com) or unofficial third party messaging apps to conduct formal business. No Recruitment Fees Milestone Technologies never requests any form of payment, "security deposit", "laptop/equipment fee", or "processing fee" at any stage of the recruitment or onboarding process. Any request for money in exchange for an interview or job offer is a scam.

📌 Senior SIEM Engineer (Kochi)
🏢 Milestone Technologies
📍 Kochi