SIEM Engineering

Job Description Summary Security Engineer (Detection & Response / SIEM & SOAR)

Experience: 7–12 years Role: Senior Security Engineer – SIEM, SOAR & Detection Engineering

1. Mandatory Skills

• SIEM Engineering: Google SecOps / Chronicle, Splunk, Microsoft Sentinel
• Detection Engineering: YARA-L, Sigma, SPL, KQL
• SOAR Automation: Google SecOps SOAR / Siemplify, Splunk SOAR / Phantom, Cortex XSOAR
• Threat Hunting: Hypothesis-driven hunting, behavioral analysis, APT detection
• Python Scripting: Security automation, REST API integrations
• Security Telemetry: BindPlane, OpenTelemetry, Logstash, Fluent Bit, Syslog
• CI/CD: Git, GitHub Actions, GitLab CI
• Security Frameworks: MITRE ATT&CK, D3FEND, Cyber Kill Chain

2. Key Responsibilities

• Design, implement, and optimize enterprise SIEM platforms.
• Develop, test, and deploy detection rules using YARA-L, Sigma, SPL, or KQL.
• Build automated incident response and investigation playbooks.
• Perform proactive threat hunting across cloud and on-premises environments.
• Integrate security logs and telemetry from multiple sources.
• Implement detection-as-code using version control and CI/CD pipelines.
• Map detection coverage to MITRE ATT&CK and identify security visibility gaps.
• Automate security workflows using Python and REST APIs.