Lead Engineer - SIEM & Detection Platforms

Are you ready to build and lead enterprise-grade detections that stop real attacks before they impact patients and critical operations? As Lead Engineer for SIEM and Detection Platforms in Chennai, you will develop methods to identify, investigate, and neutralize threats. These threats span cloud services, local infrastructure, and OT/ICS environments. Your work will enable our teams to move faster and more safely as we deliver life-changing medicines.

You will be the technical driver behind our detection strategy and content, elevating our platforms and practices while partnering with incident responders, threat intelligence, and engineering teams worldwide. Can you envision setting the standard for detection-as-code, scaling coverage across diverse technologies, and turning threat intelligence into high-fidelity signals that matter?

Detection Strategy and Leadership: Lead end-to-end detection engineering initiatives spanning threat coverage, crafting detection algorithms, and efficacy validation across SIEM, EDR, NDR, and cloud-native services; ensure focus on the most significant threats and measurable outcomes.

Apply detailed approaches to detection engineering to improve defensive posture, reduce false positives, and accelerate threat identification. Adapt proven strategies to our enterprise context.

Enterprise Detection Content Ownership: Build, optimise, and govern the organization's detection content library, mapping coverage to adversary tactics, techniques, and procedures using frameworks such as MITRE ATT&CK.

Platform Excellence and Tuning: Drive performance optimisation related to detection mechanisms and platform queries; balance sensitivity with operational efficiency to increase signal quality and reduce alert fatigue.

Provide technical oversight to external suppliers and platform vendors. Coordinate with SOC, incident response, and cyber threat analysis teams to validate efficiency and close coverage gaps.

Proactive Coverage Management: Continuously assess the evolving threat landscape, identify detection gaps, and drive systematic development of new detections to address emerging techniques across technology domains.

Innovation and Automation: Introduce and scale new detection techniques including behavioural analytics and machine learning approaches; champion detection-as-code, scripting, and orchestration to automate quality and deployment.

Standards and Quality Frameworks: Define detection engineering standards, development methodologies, and quality controls; ensure repeatability, portability, and maintainability of detection logic.

Purple Teaming and Validation: Partner with offensive security to emulate adversaries and validate detections; convert lessons learned into stronger coverage and faster time-to-detect.

Continuous Improvement and Metrics: Establish measurable benchmarks for coverage, fidelity, and time-to-detect; lead tuning and improvement cycles that demonstrably reduce false positives and improve precision.

• Education: Bachelor's degree in information security, computer science, or a related field, or equivalent experience.
• Technical expertise: At least five years of experience in detection engineering. Preferably, this is within security operations centres or detection engineering teams. Proven success leading detection initiatives and applying innovative ways at enterprise scale.
• Detection engineering fundamentals: Deep expertise in detection logic design, threat modelling, and coverage mapping; extensive experience developing detections across diverse platforms and environments for enterprise-scale operations.
• Threat detection frameworks: Comprehensive familiarity with MITRE ATT&CK, Cyber Kill Chain, and detection engineering methodologies; understanding of how adversary techniques manifest across technology domains and how detection logic must be adapted.
• Detection platforms and tooling: At least five years of hands-on experience with enterprise detection platforms, including SIEM, EDR, NDR, and cloud-native security services; advanced proficiency in platform-specific query languages, rule formats, and detection logic development.
• Threat intelligence integration: Working knowledge of how threat intelligence is consumed and translated into actionable detection logic; understanding of indicator types, threat actor TTPs, and detection prioritisation based on AstraZeneca's threat profile.
• Scripting and automation: At least three years of experience using scripting languages such as Python, PowerShell, or similar for detection logic development and automation; experience with detection-as-code practices and version control for detection content.
• Detection formats and standards: At least three years of experience with standardised detection formats, including Sigma rules, YARA signatures, and platform-specific query languages; ability to develop portable and maintainable detection logic.
• Performance optimisation: Deep understanding of detection tuning, false positive reduction, and query optimisation techniques; proven ability to balance detection accuracy with practical efficiency.
• OT/ICS detection considerations: Familiarity with operational technology environments and the unique constraints affecting detection in industrial settings; awareness of safety implications and availability requirements that influence detection approaches.
• Purple team collaboration: Experience working with offensive security teams to validate detection efficacy and identify coverage gaps; understanding of how adversary emulation informs detection improvement.
• Threat landscape knowledge: Working experience with threat intelligence, adversary TTPs, and attack techniques across cloud, on-premises, and OT environments; familiarity with how threats evolve and detection strategies must adapt.
• Global collaboration: Experience working in a global organisation with geographically dispersed teams and collaborators, including matrix working environments; ability to coordinate across time zones and cultural contexts.
• Stakeholder engagement: Substantial experience collaborating with security operations teams, incident responders, and threat intelligence analysts to identify, document, and address detection requirements; proven ability to manage relationships and communications with third-party suppliers and vendors.
• Problem-solving and innovation: Recognised internally as an expert problem solver for complex detection challenges; track record of designing, shaping, and implementing innovative detection solutions that address emerging threats.

• Certifications: Relevant security certifications related to detection development are preferred, for example GIAC GCIA, GCDA or GMON, platform-specific certifications, or threat hunting certifications.
• Implement innovative detection engineering solutions: Experience adopting new detection techniques, behavioural analytics, and computational intelligence methods; leading training and change management to ensure successful adoption.

When we put unexpected teams in the same room, we unleash bold thinking with the power to inspire life-changing medicines. In-person working gives us the platform we need to connect, work at pace and challenge perceptions. That's why we work, on average, a minimum of three days per week from the office. But that doesn't mean we're not flexible. We balance the expectation of being in the office while respecting individual flexibility. Join us in our unique and ambitious world.
#Cyber

Here, your craft has purpose. You will work at the intersection of new security technology and a mission to improve patients’ lives. You will partner with diverse experts who move quickly and learn from each other. We blend ambition with support, valuing kindness alongside high standards, so you can take intelligent risks, challenge the norm, and see your ideas translated into real-world protection. With access to modern platforms, smart colleagues, and a global network, you will stretch your skills, build transferable experience, and shape how a leading enterprise safeguards its digital future.

Seize the opportunity to lead enterprise detection engineering at scale and protect what matters—bring your expertise to AstraZeneca and make your next career-defining move today!

We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, sex, gender, gender expression, sexual orientation, age, marital status, veteran status, or disability status. We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.

Date Posted

Closing Date

AstraZeneca embraces diversity and equality of opportunity.  We are committed to building an inclusive and diverse team representing all backgrounds, with as wide a range of perspectives as possible, and harnessing industry-leading skills.  We believe that the more inclusive we are, the better our work will be.  We welcome and consider applications to join our team from all qualified candidates, regardless of their characteristics.  We comply with all applicable laws and regulations on non-discrimination in employment (and recruitment), as well as work authorization and employment eligibility verification requirements.