TDR POD Microsoft Sentinel SIEM Engineering Senior Associate (India)

Job Description

Role Overview

PwC is seeking an experienced and technically strong Threat Detection & Response (TDR) SIEM Engineer to serve as a senior engineer within the CDTR Cyber Managed Services Security. This role is responsible for SIEM/SOAR engineering and administration (primarily Microsoft Sentinel), log source onboarding and parsing, MITRE ATT&CK; aligned detection content development, and automation through Python, APIs, and AI driven SOAR playbooks. The SIEM engineer plays a critical role in improving detection fidelity, integrating security tools, and applying Generative AI to enhance detection logic and enrichment, while mentoring team members and driving continuous capability development across SOC engineering and operations.

Basic Qualifications

Minimum Degree Required: Bachelor's Degree

Minimum Years of Experience: Five (5) or more.

Minimum of 2-4 years of prior experience in Microsoft Sentinel and SOAR technologies.

Certification(s) Preferred: SIEM certifications, preferably Microsoft Certified: Security Operations Analyst Associate (SC-200). Also preferred: AZ-500, SC-100, CCNA-Security, CEH, CISSP, CTIA.

Preferred Knowledge/Skills

Demonstrates knowledge, leadership, and/or a proven record of success in the following areas:

Microsoft Sentinel SIEM and SOAR (Automation rules and Azure Logic App playbooks). Good to have experience in Google Sec Ops, Splunk and Splunk SOAR, XSIAM and XSOAR, etc.

Strong understanding of security architecture, tool integration, API development and automation.

Log ingestion to Sentinel through multiple approaches (data connectors, Azure Monitor Agent, Syslog/CEF, custom connectors, Logic Apps, Data Collection Rules), log parsing, event/field extraction (ASIM, KQL parsers).

Content development: Sentinel analytics rules, hunting queries, workbooks, reports and dashboards.

Experience with Python scripting language for automation.

Automation and AI playbook creation in SOAR (Logic Apps, Sentinel playbooks).

SIEM/SOAR engineering and administration, including workspace design, RBAC, data retention, and cost optimization.

Implement Generative AI models to enhance detection logic, log summarization,



enrichment, etc.

Overall knowledge of cyber security and a positive understanding of the MITRE framework.

Possessing and fostering an inquisitive mindset amongst team members.

Core Roles & Responsibilities

1. Detection Engineering & SIEM Use Case Development

Develop SIEM content, including advanced queries (KQL, SPL, XQL,YARA-L, etc.), detection and correlation rules, alerts, workbooks, and reports to identify security threats and anomalies.

Define detection use cases using in-depth knowledge of threats, log sources, and client environments to deliver relevant, actionable alerts.

Collaborate with team members to onboard new log sources and enhance incident response capabilities.

Develop Python based and low code automations to streamline security processes.

Contribute to the design and improvement of automated workflows using Sentinel automation rules and playbooks.

Lead alert tuning reviews and refine analytics rules and event filters to reduce false positives and improve detection fidelity.

Integrate threat intelligence into detection content to strengthen incident detection and response.

2. Threat Detection Platform Management

Oversee management and optimization of detection platforms including:

EDR (Defender for Endpoint, Crowd Strike, Sentinel One, Cortex XDR)

Email Security (Defender for Office 365, Proofpoint)

SOAR (Sentinel playbooks, XSOAR, Phantom)

Ensure log source onboarding and data quality validation

Drive automation playbooks and response orchestration

Support platform health monitoring and performance improvements

3. Advanced Threat Detection & Incident Response

Act as the primary escalation point for L2 analysts and manage complex, high severity incidents (TDR L3, L4 responsibilities)

Lead deep dive investigations across SIEM, EDR, Email Security, DLP, IAM, Network,



and Cloud platforms

Perform advanced log correlation and root cause analysis

Drive containment, eradication, and recovery efforts aligned with IR frameworks

Conduct post incident reviews and recommend detection improvements

Handle cross functional and client escalations beyond L2 scope

4. Threat Hunting & Threat Intelligence

Conduct proactive threat hunting based on hypotheses and intelligence inputs

Develop and operationalize IOCs and behavioral detection strategies

Map threats to the MITRE ATT&CK; framework

Identify stealthy attack patterns and reduce dwell time

Produce threat intelligence briefings for clients and leadership

5. Technical Leadership & Capability Development

Provide technical training and mentorship to L1/L2 analysts

Lead knowledge sharing sessions and technical workshops

Develop SOC playbooks, SOPs, and investigation runbooks

Foster an inquisitive and analytical mindset within the team

Support skill uplift initiatives and capability maturity

6. Client Relationship Management & Reporting

Provide executive ready reporting and incident summaries

Lead technical discussions during client review calls

Translate technical findings into business impact language

Act as a trusted advisor to client security leadership

7. Continuous Improvement

Stay updated on emerging threats, exploits, and vulnerabilities

Research new attack vectors and detection methodologies

Recommend enhancements in tools, automation, and workflows

Support innovation initiatives within Cyber Managed Services

Tools Experience

SIEM: Primary: Microsoft Sentinel and SOAR (Sentinel playbooks / Logic Apps)

Good to have: Google Sec Ops, Splunk, Sentinel One, XSIAM

EDR: Defender for Endpoint, Crowd Strike, Sentinel One, Cortex XDR

SOAR: Sentinel playbooks, Palo XSOAR, Splunk SOAR or D3 SOAR

Email Security: Defender for Office 365, Proofpoint

DLP, IAM (Entra ID), Proxy tools, Network Security Devices

Cloud security monitoring platforms (Defender for Cloud, Defender XDR)
Additional Information: SPOC - Aarthi M ()
Mandatory Skills - Under JD
Nice to have skills - Under JD
Clean Room Project - No

📌 TDR POD Microsoft Sentinel SIEM Engineering Senior Associate (India)
🏢 Objectwin Technology India
📍 India