Security Engineer - Detection and Response Platform

Security Engineer - Detection and Response Platform

Company: Cybervahak Consultants Private Limited

Experience: 01 Year

Location: Mumbai

Employment Type: Full-Time

Work Mode: Work from Office

ABOUT THE ROLE

We are looking for a hands-on Security Engineer who can write code, build security capabilities, investigate telemetry and translate attacker behaviour into reliable detections.

The role combines:

• SOC platform development and secure multi-tenant SaaS engineering.
• Detection engineering, rule development and tuning.
• Security telemetry collection, processing and analysis.
• Hypothesis-driven threat hunting and security investigations.

Freshers and candidates with up to one year of experience are welcome. However, practical technical capability is essential.

We expect candidates to have invested meaningful effort through college projects, home labs, internships, open-source contributions or independent security research.

You must be able to demonstrate working code, explain your investigation methodology and justify your technical decisions.

KEY RESPONSIBILITIES

1. SOC Platform Development & Security Engineering

• Develop, test, debug and maintain SOC platform services, APIs, integrations and endpoint-agent components.
• Implement alert management, incident and case workflows, SLA handling, dashboards and reporting capabilities.
• Build integrations with security products using REST APIs, webhooks and polling mechanisms.
• Parse, normalise and enrich security telemetry from multiple sources.
• Troubleshoot missing, delayed, malformed or duplicate events.
• Implement reliable ingestion pipelines using queues, retries, checkpoints, deduplication, failure handling and event replay.
• Monitor pipeline health and troubleshoot performance under realistic workloads.
• Implement secure authentication, authorisation, tenant isolation, audit trails, secrets management and resource controls.
• Write automated tests to validate access boundaries, security controls and tenant isolation.
• Identify and fix security or reliability defects through code reviews, testing and CI workflows.
• Maintain technical documentation, operating procedures and implementation records.

2. Detection Engineering & Rule Development

• Develop and test detection rules and queries using SIEM query languages and Sigma.
• Map attacker techniques and suspicious behaviour to the MITRE ATT&CK framework.
• Validate telemetry availability, parsing accuracy and detection logic.
• Investigate false positives and implement narrowly scoped, evidence-based rule tuning.
• Develop correlation and behavioural detections across endpoint, identity, network, cloud and Microsoft 365 environments.
• Handle detection challenges involving time windows, late or repeated events and differences across client environments.
• Validate rules using controlled testing, benign activity and authorised attack simulations.
• Identify detection coverage gaps and improve alert quality based on investigation findings.

3. Threat Hunting & Security Investigations

• Convert threat intelligence, security advisories and client concerns into testable threat-hunting hypotheses.
• Identify relevant telemetry sources, develop queries, establish baselines and correlate evidence.
• Investigate suspicious processes, authentication activity, persistence mechanisms, remote access, lateral movement, command-and-control and potential data exfiltration.
• Distinguish legitimate administrative or business activity from malicious behaviour using technical evidence.
• Preserve investigation evidence and document timelines, findings and limitations.
• Prepare threat-hunting reports, investigation summaries, detection recommendations and technical handovers.
• Assess potential business impact before response actions and follow approved incident response procedures.
• Escalate critical findings and prioritise exploitable security defects and service failures.

REQUIRED TECHNICAL SKILLS

1. Programming & Software Engineering

• Strong hands-on programming skills in TypeScript/JavaScript or Go.
• Ability to use Python or shell scripting for security automation and data analysis.
• Practical knowledge of Git, REST APIs, JSON, SQL, Linux and automated testing.
• Ability to independently write, debug, test and explain working code.

2. Security Platforms & Detection

• Hands-on exposure to at least one SIEM, EDR or security analytics platform, such as Wazuh, Elastic, Splunk, Microsoft Sentinel/Defender, QRadar, Chronicle, CrowdStrike or SentinelOne.
• Knowledge of MITRE ATT&CK, Sigma and event schemas such as ECS.
• Ability to write detection queries and understand false positives, false negatives, thresholds, time windows and coverage gaps.
• Understanding of Windows Security Events, Sysmon, Linux authentication and audit logs, process trees, network telemetry and relevant Microsoft 365 audit sources.

3. Networking, Systems & Application Security

• Understanding of HTTP, TCP/IP, DNS, TLS, operating-system processes, permissions and authentication.
• Working knowledge of secure API design, access controls, multi-tenancy and common injection vulnerabilities.
• Understanding of webhook authentication, secure credential handling and protection against untrusted inputs.
• Familiarity with queues, retries, idempotency, stateful correlation and operational monitoring.
• Ability to reason about pipeline failures, capacity limitations, outages, recovery and cross-tenant impact.

4. Security Operations & Communication

• Strong analytical thinking and evidence-based investigation skills.
• Ability to document technical findings clearly and accurately.
• Disciplined handling of confidential and sensitive information.
• Understanding of the relevance of CERT-In reporting and log-retention requirements to security operations.

QUALIFICATIONS & PRACTICAL EXPERIENCE

• Degree in Engineering, Computer Science, Information Technology, Cybersecurity or a related discipline.
• Fresher or up to one year of relevant professional experience.
• Demonstrable practical work through personal projects, internships, home labs, research or open-source contributions.

Examples of relevant work include:

• Developing a security platform feature or API connector.
• Building a SIEM lab and creating custom detection rules.
• Developing an endpoint security tool or automation script.
• Conducting threat hunts and documenting findings.
• Creating a detection rule pack or security research write-up.
• Contributing meaningfully to an open-source security project.

Candidates must be prepared to explain what they personally built, demonstrate its functionality, discuss technical challenges and explain how they resolved failures.

Share only public, owned or appropriately sanitised material.

ADDITIONAL SKILLS (GOOD TO HAVE)

• Docker, CI/CD, cloud deployment and observability.
• Stream processing and endpoint-agent development.
• SOAR and UEBA workflows.
• YARA, STIX/TAXII, CEF and syslog.
• Authorised attack simulation, vulnerability research or responsible disclosure.
• Relevant cybersecurity certifications supported by practical experience.

WHAT WE EXPECT FROM YOU

• Take ownership of assigned engineering and investigation tasks.
• Investigate problems independently before escalating.
• Reproduce defects, test fixes and verify outcomes.
• Research unfamiliar technologies and apply technical documentation effectively.
• Communicate blockers early and incorporate technical review feedback.
• Use AI-assisted tools responsibly, validating every generated solution and remaining accountable for submitted work.

WHAT WE OFFER

• Hands-on experience across cybersecurity product development, detection engineering and threat hunting.
• Exposure to practical security challenges across client environments.
• Direct technical feedback and opportunities to develop advanced security engineering capabilities.
• Increasing technical ownership based on demonstrated performance.
• Compensation aligned with demonstrated technical capability.

KEY SKILLS

Security Engineering, SOC Platform Development, Detection Engineering, Threat Hunting, SIEM, EDR, TypeScript, JavaScript, Go, Python, Sigma, MITRE ATT&CK, Windows Security, Sysmon, Linux, SQL, REST APIs, Multi-Tenancy, Secure Coding, Git, CI/CD