Architects and optimizes SIEM and Cribl telemetry pipelines; onboards diverse security data sources; develops MITRE ATT&CK-aligned detections; tunes alerts; builds dashboards and hunting queries; monitors ingestion health, costs, and coverage; troubleshoots pipeline and detection failures; mentors engineers and analysts; and maintains technical documentation, runbooks, metrics, and governance standards.
Duties & Responsibilities
- Architect and optimize SIEM platforms (e.g., Microsoft Sentinel, Splunk), including ingestion pipelines, parsing/normalization, enrichment, and correlation logic.
- Engineer and operate Cribl Stream and Cribl Edge for log routing, filtering, transformation, enrichment, data reduction, and destination fanout (SIEM, data lake, cold storage).
- Design and maintain telemetry onboarding with schema mapping, collectors/agents, connectors, API integrations, replay, and edge collection for diverse sources (endpoint, network, cloud, identity, app).
- Develop advanced detections and analytics (rules, queries, correlations) aligned to MITRE ATT&CK, emerging TTPs, and threat intelligence; measure detection efficacy and coverage.
- Lead systematic alert tuning to reduce false positives and improve signaltonoise, leveraging Cribl pipelines and SIEM analytics to standardize high-fidelity events.
- Build investigation assets (dashboards, hunting queries, data models) that accelerate SOC workflows and rootcause analysis across telemetry domains.
- Monitor ingestion health and cost (EPS/GB/day, license utilization), implement Criblbased data controls (sampling, routing, suppression) to ensure reliability and budget adherence.
- Perform RCA on detection gaps and pipeline failures; implement durable fixes in Cribl routes/pipelines and SIEM parsing/enrichment layers.
- Mentor engineers and analysts on KQL/SPL, detection engineering patterns, Cribl pipeline design, and telemetry best practices; conduct peer reviews and standards governance.
- Maintain documentation: data dictionaries, detection catalogs, Cribl pipeline/runbooks, ingestion maps, and metrics reporting on coverage, fidelity, MTTR, and pipeline SLOs.
Requirements
Basic Qualifications
- Solid understanding of network protocols, data protection mechanisms, and threat landscapes
- Hands-on experience with security systems, including firewalls, intrusion detection systems, anti-virus software, etc.
Preferred Qualifications
- Industry-recognized certifications (e.g., CISSP, CISM, CEH)
- Master’s degree in Cybersecurity or a related field
Similar Jobs
eCommerce • Retail • Software
Leads enterprise SIEM and detection engineering, architecting Microsoft Sentinel or Splunk platforms and operating Cribl telemetry pipelines. Designs detections across endpoint, network, identity, cloud, and application environments; improves ingestion quality, reduces false positives, monitors costs, and performs root-cause analysis. Builds dashboards and investigation assets aligned with MITRE ATT&CK, maintains documentation and governance, and mentors engineers and analysts on detection engineering, KQL, SPL, and Cribl practices.
Top Skills:
Antivirus SoftwareApi IntegrationsCribl EdgeCribl StreamFirewallsIntrusion Detection SystemsKqlMicrosoft SentinelMitre Att&CkSIEMSplSplunk
Aerospace • Artificial Intelligence • Cloud • Machine Learning • Software • Cybersecurity • Defense
Lead architectural design and innovation for aerospace tooling solutions within the ANTHEM platform. Collaborate with business and technology leaders to align architecture with strategic goals, ensuring scalable, secure, compliant, and reliable solutions. Guide software development, system integration, validation, and engineering productivity initiatives. Build and support a strong technical team through recruiting, talent development, succession planning, retention, and inclusive leadership.
Top Skills:
.NetAvionics Communication ProtocolsBambooC#C++Ci/CdCloud ComputingGenerative AiGrafana LokiLaunchdarklyMicroservicesOctopusOpenshiftPythonService-Oriented Architecture (Soa)
Digital Media • Information Technology • News + Entertainment
Develops and optimizes data structures, ingestion frameworks, ETL pipelines, warehouses, and data lakes. Ensures data quality, governance, lineage, and compliance while supporting analytics and machine learning initiatives. Designs storage solutions across on-premises and cloud platforms, manages migrations, develops APIs, monitors data flows, collaborates with technology and analytics teams, and participates in code reviews and model deployments.
Top Skills:
Amazon RedshiftAPIsAws S3DatabricksETLKubernetesMinioTeradata
What you need to know about the Chennai Tech Scene
To locals, it's no secret that South India is leading the charge in big data infrastructure. While the environmental impact of data centers has long been a concern, emerging hubs like Chennai are favored by companies seeking ready access to renewable energy resources, which provide more sustainable and cost-effective solutions. As a result, Chennai, along with neighboring Bengaluru and Hyderabad, is poised for significant growth, with a projected 65 percent increase in data center capacity over the next decade.
