Engineers and maintains SIEM and Cribl telemetry pipelines, develops MITRE ATT&CK-aligned detections, onboards and validates log sources, tunes false positives, and creates queries, dashboards, and data models for SOC and incident response teams. Monitors ingestion health and pipeline performance, supports investigations, documents engineering processes, resolves telemetry issues, and mentors junior analysts and engineers on SIEM and Cribl practices.
Duties & Responsibilities
- Engineer and maintain SIEM ingestion pipelines, including data connectors, parsers, normalization, and enrichment across endpoint, network, cloud, identity, and app telemetry sources.
- Build, tune, and update detection rules, correlation logic, and analytics aligned to MITRE ATT&CK, threat intelligence, and evolving TTPs.
- Operate and enhance Cribl Stream and Cribl Edge pipelines for log routing, transformation, filtering, enrichment, and delivery optimization.
- Support onboarding of new log sources, including schema mapping, troubleshooting ingestion failures, and validating data quality and completeness.
- Assist in reducing false positives and improving signaltonoise through SIEM tuning, enrichment enhancements, and Cribl workflow adjustments.
- Develop queries, dashboards, and data models used by SOC and IR teams for investigations, monitoring, and hunting.
- Monitor telemetry ingestion metrics, SIEM health, license usage, and Cribl pipeline performance; identify and resolve operational issues.
- Perform investigation support by validating detections, analyzing telemetry gaps, and implementing fixes to improve future coverage.
- Mentor junior analysts and engineers on SIEM query languages (KQL/SPL), detection development, logging best practices, and Cribl pipeline fundamentals.
- Maintain SIEM and telemetry documentation including data dictionaries, ingestion maps, detection catalogs, and engineering runbooks.
Requirements
Basic Qualifications
- Proficient in various cybersecurity frameworks and standards.
- Experience with security tools such as SIEM, firewalls, and intrusion detection systems.
Preferred Qualifications
- Relevant certifications (e.g., CISSP, CISM, CEH).
- Master’s degree in Cybersecurity or related field.
Similar Jobs
Information Technology • Software • Business Intelligence • Consulting
Manage and configure vulnerability scanners (Nessus, Nexpose, Qualys), analyze and remediate vulnerabilities, perform infrastructure and web application penetration testing, create customized reports (SQL), validate false positives, automate processes, and coordinate remediation with stakeholders and PenTest teams.
Top Skills:
AutomationDynamic AnalysisFortifyInteractive Application Security TestingNessusNexposePenetration TestingQualys GuardSQLStatic Analysis
.jpeg)
Financial Services
Manage and supervise corporate security operations and officers, enforce access and safety policies, operate Security Operations Center, maintain security systems (access control, CCTV, visitor management), respond to incidents and coordinate with first responders, document shift activity and administrative records, and align risk and compliance processes into daily operations. Role requires on-site presence.
Top Skills:
Avigilon Unity 8Avigilon Unity 9C-Cure 9000Incident Report Management SystemSecurity Operation Center (Soc)Two-Way RadiosVisitor Management System
Digital Media • Information Technology • News + Entertainment
Designs, implements, and maintains secure enterprise and data center network infrastructure. Manages Fortinet, Palo Alto, and F5 firewalls and load balancers; supports routing, switching, high availability, disaster recovery, monitoring, incident response, compliance, documentation, and automation. Collaborates with infrastructure teams and vendors, resolves complex production issues, performs root cause analysis, and mentors junior engineers.
Top Skills:
AnsibleBgpF5 Big-IpF5 DnsF5 GtmF5 LtmFortinetGitHsrpIgmpLacpMlagMulticastOspfPalo Alto FirewallsPimPort-ChannelPythonRest ApisStpVpcVrfVrrp
What you need to know about the Chennai Tech Scene
To locals, it's no secret that South India is leading the charge in big data infrastructure. While the environmental impact of data centers has long been a concern, emerging hubs like Chennai are favored by companies seeking ready access to renewable energy resources, which provide more sustainable and cost-effective solutions. As a result, Chennai, along with neighboring Bengaluru and Hyderabad, is poised for significant growth, with a projected 65 percent increase in data center capacity over the next decade.
