Senior Security Engineer

About the Role

Join our team as a Senior Security Engineer - SIEM. You will be instrumental in supporting our Engineering Qualification operating model, managing technical assessments, design, onboarding, validation, and optimization of security telemetry, cloud integrations, and advanced SIEM use cases.

Key Responsibilities

• Lead the technical qualification of new SIEM onboarding requests, integrations, and security telemetry requirements globally.
• Assess solution architecture, including security controls, authentication methods, connectivity, network dependencies, and access protocols.
• Design and review log onboarding patterns, telemetry pipelines, and robust SIEM integration architectures supporting Azure environments.
• Define and implement Data Collection Rules (DCRs), parsers, transformations, normalization, and schema mappings with precision.
• Promote the adoption of Advanced Security Information Model (ASIM) normalization standards where applicable to enhance data utility.
• Estimate telemetry volumes accurately while assessing ingestion capabilities, storage needs, retention policies, and operational cost implications for Indian markets and beyond.
• Create scalable and reusable ingestion patterns across diverse environments including cloud, on-premises Linux, containers, and third-party platforms.
• Develop and review sophisticated KQL queries, analytics rules, detections, hunting strategies, and tailored SIEM use cases.
• Troubleshoot complex issues related to collection, ingestion, parsing, connectivity, authentication, and data quality challenges.
• Validate integrations through rigorous functional, security, performance, and operational testing protocols.
• Cultivate reusable engineering standards, onboarding templates, reference architectures, automation scripts, and technical accelerators.
• Foster collaboration with Security Engineering, Threat Monitoring, Technology & Infrastructure teams, application owners, and platform stakeholders.
• Review technical designs for strict alignment with security best practices, architecture principles, and operational standards.
• Drive continuous improvement of telemetry quality, coverage, performance metrics, and cost efficiency strategies.
• Mentor junior engineers and provide essential technical oversight during onboarding and troubleshooting activities.
• Maintain high-quality engineering documentation, including technical decision records (ADRs), runbooks, and implementation standards for global teams.

Required Experience & Skills

• 8+ years of experience in Security Engineering, Operations Engineering, SIEM Engineering, Cloud Security, or related disciplines preferred with expertise relevant to the Indian IT landscape.
• Advanced Microsoft Azure certification and hands-on experience including Entra ID, Azure Networking, Log Analytics, Azure Monitor, Key Vault, and RBAC management.
• Advanced proficiency with Microsoft Sentinel (preferred) OR strong equivalent experience with another enterprise SIEM platform such as Splunk or Elastic Security.
• Mastery of Kusto Query Language (KQL) for complex detection engineering tasks.
• Strong hands-on knowledge covering log ingestion, parsing methodologies, normalization techniques, enrichment strategies, and schema design patterns.
• Demonstrated experience with Azure Monitor Agent (AMA), Syslog, Logstash, Fluent Bit, Beats, or equivalent collection technologies in production environments.
• Proven track record designing and maintaining Data Collection Rules (DCRs) and complex telemetry pipelines within hybrid cloud setups.
• In-depth understanding of security architecture principles, identity management, authentication mechanisms, network security protocols, and secure integration patterns.
• Expertise in estimating telemetry volumes, retention planning strategies, and SIEM cost optimization models for scalable operations.
• Solid working knowledge of Linux distributions and container platforms like Docker/Kubernetes.
• Familiarity with Git-based version control workflows and CI/CD practices essential for DevSecOps pipelines.
• Exceptional ability to troubleshoot complex integration issues, root-cause analysis skills in telemetry data streams.
• Experience mentoring or technically guiding junior engineers through career growth programs.

Desirable Experience

• Familiarity with Splunk, IBM QRadar, Elastic Security, or other enterprise SIEM platforms to broaden your cloud security horizon.
• Background in infrastructure-as-code (IaC) and automation technologies such as Terraform, Bicep, Azure DevOps, or GitHub Actions for efficient deployment pipelines.
• Experience developing detections mapped to MITRE ATT&CK frameworks or equivalent cybersecurity threat intelligence models.
• Knowledge of cloud-native security monitoring strategies and multi-cloud telemetry architectures across hybrid environments.
• Holding relevant certifications from Microsoft (Azure Security), SIEM vendors, or recognized cybersecurity bodies (CISSP, CISM).