Roles & Responsibilities

SIEM Platform Engineering

- Design, deploy, configure, and maintain Microsoft Sentinel and SentinelOne Singularity SIEM/Security platforms.
- Manage and troubleshoot log collectors, connectors, agents, data ingestion pipelines, and log forwarding mechanisms.
- Develop, customize, and optimize parsers, data normalization, and log parsing configurations.
- Onboard new security assets, applications, infrastructure, and data sources into the SIEM platform.
- Identify and resolve challenges related to existing asset integrations, missing logs, parsing issues, and data quality.
- Perform POCs and feasibility assessments for onboarding new security technologies and log sources.
- Ensure proper log visibility, data completeness, field mapping, normalization, and ingestion quality.

Asset Onboarding & Integrations

- Lead end-to-end onboarding of recent assets and technologies into the SIEM/SOAR platforms.

- Integrate security solutions across

- Cloud Security

- Network Security

- Endpoint Security

- Data Security

- Email Security

- Identity and Access Management

- Vulnerability Management

- Application and Web Security

- Threat Intelligence Platforms
- Other cybersecurity solutions and custom applications
- Work with vendors and internal teams to resolve integration and compatibility issues.
- Develop and validate custom integrations using APIs, syslog, REST APIs, webhooks, agents, connectors, and other supported integration methods.

Automation & SOAR Engineering

- Design and implement automation rules and automation policies.




- Develop and maintain SOAR playbooks for automated incident response and remediation.
- Build use cases for alert enrichment, investigation, ticket creation, notification, containment, and remediation.
- Integrate SIEM/SOAR platforms with external security tools and enterprise applications.
- Develop automated workflows to reduce SOC manual effort and improve incident response time.
- Continuously optimize existing automation and SOAR playbooks based on operational requirements.

Troubleshooting & Optimization

- Troubleshoot complex issues related to:

- Log collection and ingestion
- Parser failures and data mapping

- Asset onboarding

- Connectors and integrations

- APIs and authentication

- Automation and playbook failures

- Data visibility and quality
- Perform root cause analysis and implement permanent fixes.
- Optimize SIEM performance, log ingestion, storage, and operational efficiency.

Collaboration & Documentation

- Work closely with SOC analysts, security architects, infrastructure teams, cloud teams, and third-party vendors.
- Create and maintain technical documentation for integrations, onboarding procedures, parsers, playbooks, and operational processes.




- Provide technical guidance and support to SOC teams on SIEM and SOAR capabilities.
- Stay updated with the latest Microsoft Sentinel, SentinelOne, cloud security, and cybersecurity integration capabilities.

Required Technical Skills

- Strong hands-on experience with Microsoft Sentinel.
- Strong experience with SentinelOne Singularity platform, particularly SIEM, security data ingestion, integrations, and automation capabilities.
- Experience with SIEM architecture, log management, log ingestion, parsing, normalization, and troubleshooting.
- Experience developing and troubleshooting SIEM parsers and custom log integrations.
- Experience with Microsoft Sentinel Data Connectors, Analytics Rules, Automation Rules, and Logic Apps.
- Experience designing and developing SOAR playbooks and automated response workflows.
- Strong knowledge of REST APIs, JSON, webhooks, Syslog, CEF, and other security log formats.
- Scripting knowledge in Python, PowerShell, or similar scripting languages.
- Experience integrating cybersecurity solutions across cloud, network, endpoint, data, and email security domains.

Preferred Skills

- Microsoft Sentinel and SentinelOne technical certifications.
- Experience with Microsoft Azure security services and Azure Logic Apps.
- Knowledge of MITRE ATT&CK; framework and security incident lifecycle.
- Experience with API-based and custom SIEM integrations.
- Experience working with SOC, Managed Security Services, or enterprise security environments.
- Knowledge of detection engineering and threat use cases.

📌 SIEM /SOAR Platform Engineer (Bengaluru)
🏢 Hitachi Systems
📍 Bengaluru