Role & responsibilities

- Manage, maintain, and optimize Security Operations Center (SOC) platforms, including SIEM, SOAR, and security analytics solutions.
- Administer and support Microsoft Sentinel, Microsoft Defender XDR, and Azure security services to ensure platform stability and performance.
- Design, implement, and maintain log ingestion pipelines using Syslog, Windows Event Forwarding (WEF), Azure Monitor Agent (AMA), Event Hub, and other data connectors.
- Monitor platform health, data flow, integrations, and performance, ensuring timely identification and resolution of issues.
- Develop and maintain automation workflows using Azure Logic Apps, Azure Functions, PowerShell, Python, and SOAR technologies.
- Perform platform upgrades, configuration management, patching, and troubleshooting activities across security monitoring infrastructure.
- Build and maintain CI/CD pipelines and Infrastructure-as-Code (IaC) solutions using Azure DevOps, Git, and automation frameworks.
- Support integration of security tools and technologies, including endpoint, network, cloud, and third-party security solutions.
- Create and optimize queries, dashboards, analytics rules, workbooks, and detection content using KQL.
- Collaborate with Detection Engineering, Threat Hunting, SOC Analysts, Incident Response, and Infrastructure teams to improve security operations.
- Ensure platform availability, scalability, reliability,



and compliance with organizational security standards and best practices.
- Document platform configurations, operational procedures, troubleshooting guides, and architecture diagrams.

Preferred Candidate Profile

- 5+ years of experience in SIEM Engineering, SOC Engineering, Security Platform Engineering, or Cyber Security Operations.
- Strong hands-on experience with Microsoft Sentinel, Microsoft Defender XDR, and Azure security technologies.
- Proven expertise in managing SIEM/SOAR platforms, log management, detection engineering support, and security tooling integrations.
- Strong knowledge of KQL (Kusto Query Language), PowerShell, and Python scripting for automation and operational efficiency.
- Experience with log collection technologies, including Syslog, WEF, Azure Monitor Agent (AMA), Event Hub, and custom integrations.
- Hands-on experience with Logstash, Cribl, or similar telemetry and data pipeline technologies.
- Familiarity with Azure DevOps, Git, CI/CD practices, and Infrastructure-as-Code methodologies.
- Experience implementing and supporting Azure Logic Apps, Azure Functions, and SOAR platforms such as Cortex XSOAR.
- Strong troubleshooting, incident management, and root cause analysis skills.
- Excellent communication and stakeholder management skills with the ability to work in a global, rapid-paced security environment.

📌 Detection Engineer (Chennai)
🏢 Capgemini
📍 Chennai