Job Description: TDR POD Splunk SIEM Engineering Senior Associate (India)

Job Description

Role Overview

PwC is seeking an experienced and technically strong Threat Detection & Response (TDR) SIEM Engineer to serve as a senior engineer within the CDTR Cyber Managed Services Security team. This role is responsible for SIEM/SOAR engineering and administration (primarily Splunk Enterprise / Splunk Cloud, Splunk Enterprise Security and Splunk SOAR), log source onboarding and parsing, MITRE ATT&CK-aligned; detection content development, and automation through Python, APIs and AI-driven SOAR playbooks.

The SIEM engineer plays a critical role in improving detection fidelity, integrating security tools and applying Generative AI to enhance detection logic and enrichment, while mentoring team members and driving continuous capability development across SOC engineering and operations.

Basic Qualifications:

Minimum Degree Required: Bachelor's Degree

Minimum Years of Experience: Five (5) or more

Minimum of 2 4 years of hands-on experience in Splunk Enterprise or Splunk Cloud, Splunk Enterprise Security and Splunk SOAR

Certification(s) Preferred: Splunk certifications, preferably:

Splunk Certified Cybersecurity Defense Engineer

Splunk Enterprise Certified Admin or Splunk Cloud Certified Admin

Splunk Core Certified Advanced Power User

Also preferred: CISSP, GCIH, CEH, CTIA, CCNA

Preferred Knowledge/Skills: Demonstrates knowledge, leadership, and/or a proven record of success in the following areas:

Splunk Enterprise / Splunk Cloud Platform, Splunk Enterprise Security and Splunk SOAR. Good to have experience in Microsoft Sentinel, Google Sec Ops, Cortex XSIAM and XSOAR

Log ingestion through Universal and Heavy Forwarders, HTTP Event Collector (HEC), syslog (Splunk Connect for Syslog), Splunkbase add-ons, DB Connect and cloud inputs, with filtering and routing using Ingest Actions or Edge Processor

Log parsing and normalization: sourcetypes, props.conf / transforms.conf, index-time and search-time field extractions, CIM data models and data model acceleration

Content development: advanced SPL (including tstats, macros and lookups), Enterprise Security correlation searches, Risk-Based Alerting (RBA), dashboards (Dashboard Studio) and reports

Automation and AI playbook creation in Splunk SOAR, including the visual playbook editor, Python custom functions, apps and assets

Detection-as-code using Git and CI/CD, including Splunk Security Content (ESCU)

Implementing Generative AI and machine learning to enhance detection logic, log summarization and enrichment (e.g., Splunk AI Assistant for SPL, Machine Learning Toolkit)

Strong understanding of security architecture, tool integration and API development, with Python scripting using the Splunk REST API and SDKs





Overall knowledge of cyber security and a good understanding of the MITRE ATT&CK; framework

Possessing and fostering an inquisitive mindset amongst team members

Core Roles & Responsibilities

1. Detection Engineering & SIEM Use Case Development

Develop Splunk content, including advanced SPL queries, Enterprise Security correlation searches, risk rules, alerts, dashboards and reports to identify security threats and anomalies

Define detection use cases using in-depth knowledge of threats, log sources and client environments to deliver relevant, actionable alerts

Implement and tune Risk-Based Alerting to reduce alert volume and surface high-fidelity, entity-based incidents

Adopt and customize Splunk Security Content (ESCU), mapping detections to MITRE ATT&CK; and performing coverage and gap analysis

Collaborate with team members to onboard recent log sources and enhance incident response capabilities

Develop Python-based and low-code automations, and contribute to the design and improvement of automated workflows using Splunk SOAR playbooks

Lead alert tuning reviews, refining correlation searches, throttling and suppression to reduce false positives and improve detection fidelity

Integrate threat intelligence into detection content to strengthen incident detection and response

Maintain detection content under version control and support detection-as-code practices (peer review, testing, CI/CD deployment)

2. Threat Detection Platform Management

Engineer and administer Splunk Enterprise and Splunk Cloud environments, including indexer and search head clusters, deployment server, forwarder management, apps and add-ons

Ensure log source onboarding, parsing and CIM normalization, and validate data quality and data model acceleration

Monitor platform health and performance (search performance, skipped searches, indexing queues) and drive improvements

Plan and execute Splunk platform, Enterprise Security and app upgrades, and support migrations such as on-premises to Splunk Cloud

Oversee management and optimization of integrated detection platforms, including:

EDR (Defender for Endpoint, Crowd Strike, Sentinel One, Cortex XDR)

Email Security (Proofpoint, Defender for Office 365)

SOAR (Splunk SOAR, XSOAR)

Drive automation playbooks and response orchestration

3. Advanced Threat Detection & Incident Response





Act as the primary escalation point for L2 analysts and manage complex, high-severity incidents (TDR L3 / L4 responsibilities)

Lead deep-dive investigations across SIEM, EDR, Email Security, DLP, IAM, Network and Cloud platforms, performing advanced log correlation and root cause analysis

Drive containment, eradication and recovery efforts aligned with IR frameworks

Conduct post-incident reviews and recommend detection improvements

Handle cross-functional and client escalations beyond L2 scope

4. Threat Hunting & Threat Intelligence

Conduct proactive threat hunting in Splunk based on hypotheses and intelligence inputs

Develop and operationalize IOCs and behavioral detection strategies mapped to the MITRE ATT&CK; framework

Identify stealthy attack patterns and reduce dwell time

Produce threat intelligence briefings for clients and leadership

5. Technical Leadership & Capability Development

Provide technical training and mentorship to L1/L2 analysts and Associate engineers

Lead knowledge-sharing sessions and technical workshops, including SPL and Splunk administration upskilling

Develop SOC playbooks, SOPs and investigation runbooks

Foster an inquisitive and analytical mindset within the team

Support skill uplift initiatives and capability maturity

6. Client Relationship Management & Reporting

Provide executive-ready reporting and incident summaries

Lead technical discussions during client review calls

Translate technical findings into business-impact language

Act as a trusted advisor to client security leadership

7. Continuous Improvement

Stay updated on emerging threats, exploits and vulnerabilities

Research new attack vectors and detection methodologies

Track Splunk product roadmaps and new capabilities, and assess their value for clients

Recommend enhancements in tools, automation and workflows

Support innovation initiatives within Cyber Managed Services

Tools Experience:

SIEM: Primary Splunk Enterprise / Splunk Cloud Platform with Splunk Enterprise Security. Good to have Microsoft Sentinel, Google Sec Ops, Cortex XSIAM

SOAR: Primary Splunk SOAR. Good to have Palo Alto XSOAR, Google Sec Ops SOAR, Logic Apps, D3 SOAR

Splunk Ecosystem: Universal / Heavy Forwarders, HEC, Splunk Connect for Syslog, Splunkbase add-ons, DB Connect, Ingest Actions / Edge Processor, Machine Learning Toolkit, Splunk AI Assistant for SPL

EDR & Email Security: Defender for Endpoint, Crowd Strike, Sentinel One, Cortex XDR; Proofpoint, Defender for Office 365

Other: DLP, IAM, proxy, network security devices, cloud security monitoring (AWS, Azure, GCP); Git, CI/CD
Additional Information: SPOC - Aarthi M ()
Mandatory Skills - Under JD
Nice to have skills - Under JD
Clean Room Project - No

📌 TDR POD Splunk SIEM Engineering Senior Associate (India)
🏢 Objectwin Technology India
📍 India