Architects and optimizes SIEM and Cribl telemetry pipelines; onboards diverse security data sources; develops MITRE ATT&CK-aligned detections; tunes alerts; builds dashboards and hunting queries; monitors ingestion health, costs, and coverage; troubleshoots pipeline and detection failures; mentors engineers and analysts; and maintains technical documentation, runbooks, metrics, and governance standards.
Duties & Responsibilities
- Architect and optimize SIEM platforms (e.g., Microsoft Sentinel, Splunk), including ingestion pipelines, parsing/normalization, enrichment, and correlation logic.
- Engineer and operate Cribl Stream and Cribl Edge for log routing, filtering, transformation, enrichment, data reduction, and destination fanout (SIEM, data lake, cold storage).
- Design and maintain telemetry onboarding with schema mapping, collectors/agents, connectors, API integrations, replay, and edge collection for diverse sources (endpoint, network, cloud, identity, app).
- Develop advanced detections and analytics (rules, queries, correlations) aligned to MITRE ATT&CK, emerging TTPs, and threat intelligence; measure detection efficacy and coverage.
- Lead systematic alert tuning to reduce false positives and improve signaltonoise, leveraging Cribl pipelines and SIEM analytics to standardize high-fidelity events.
- Build investigation assets (dashboards, hunting queries, data models) that accelerate SOC workflows and rootcause analysis across telemetry domains.
- Monitor ingestion health and cost (EPS/GB/day, license utilization), implement Criblbased data controls (sampling, routing, suppression) to ensure reliability and budget adherence.
- Perform RCA on detection gaps and pipeline failures; implement durable fixes in Cribl routes/pipelines and SIEM parsing/enrichment layers.
- Mentor engineers and analysts on KQL/SPL, detection engineering patterns, Cribl pipeline design, and telemetry best practices; conduct peer reviews and standards governance.
- Maintain documentation: data dictionaries, detection catalogs, Cribl pipeline/runbooks, ingestion maps, and metrics reporting on coverage, fidelity, MTTR, and pipeline SLOs.
Requirements
Basic Qualifications
- Solid understanding of network protocols, data protection mechanisms, and threat landscapes
- Hands-on experience with security systems, including firewalls, intrusion detection systems, anti-virus software, etc.
Preferred Qualifications
- Industry-recognized certifications (e.g., CISSP, CISM, CEH)
- Master’s degree in Cybersecurity or a related field
Similar Jobs
Digital Media • Information Technology • News + Entertainment
Designs, implements, and maintains secure enterprise and data center network infrastructure. Manages Fortinet, Palo Alto, and F5 firewalls and load balancers; supports routing, switching, high availability, disaster recovery, monitoring, incident response, compliance, documentation, and automation. Collaborates with infrastructure teams and vendors, resolves complex production issues, performs root cause analysis, and mentors junior engineers.
Top Skills:
AnsibleBgpF5 Big-IpF5 DnsF5 GtmF5 LtmFortinetGitHsrpIgmpLacpMlagMulticastOspfPalo Alto FirewallsPimPort-ChannelPythonRest ApisStpVpcVrfVrrp
Digital Media • Information Technology • News + Entertainment
Build, maintain, and improve a software automation platform, including workflows, CI/CD pipelines, and Go- or Python-based tools. Collaborate with stakeholders to identify automation opportunities, troubleshoot incidents, improve reliability, and participate in on-call support. The role also involves system design, technical documentation, mentoring junior staff, software releases, performance analysis, and cross-functional collaboration with quality assurance.
Top Skills:
ArgocdAWSCi/CdDockerGoInfrastructure As CodeJenkinsKubernetesPythonTerraform
Digital Media • Information Technology • News + Entertainment
Builds, configures, maintains, and tests cybersecurity systems and infrastructure. Conducts security assessments, vulnerability testing, audits, and technical analysis across networks, applications, operating systems, and network devices. Supports security architecture, develops policies and documentation, recommends vulnerability remediation, and troubleshoots network stacks at scale. Requires knowledge of secure routing, DNS/DNSSEC, SDN, automation, high-availability architectures, and varied network platforms. Variable schedules, including nights and weekends, may be required.
Top Skills:
Antivirus SystemsCmtsCybersecurityDnsDnssecDocsisFirewallsIntrusion Detection SystemsNetwork AutomationNetwork MonitoringNetwork SecurityOperating SystemsOptical DevicesPonRoutersSdnSecure RoutingSwitchesTcpVcmtsVulnerability Assessment
What you need to know about the Chennai Tech Scene
To locals, it's no secret that South India is leading the charge in big data infrastructure. While the environmental impact of data centers has long been a concern, emerging hubs like Chennai are favored by companies seeking ready access to renewable energy resources, which provide more sustainable and cost-effective solutions. As a result, Chennai, along with neighboring Bengaluru and Hyderabad, is poised for significant growth, with a projected 65 percent increase in data center capacity over the next decade.
