Detection Engineer

Capgemini; Chennai, Bengaluru, Mumbai; Hybrid; INR 1,800,000 - 3,000,000; Full time

Job summary

Capgemini in Chennai is looking for an experienced SOC Platform Engineer to manage and optimize SOC platforms, including SIEM, SOAR, and security analytics, and to administer Microsoft Sentinel, Defender XDR, and Azure security services for stability and performance.

You will design log ingestion pipelines, monitor data flows, develop automation with Azure Logic Apps, Functions, PowerShell, and Python, and build CI/CD pipelines and IaC using Azure DevOps and Git, collaborating with global teams.

Qualifications

• 5+ years of experience in SIEM Engineering, SOC Engineering, Security Platform Engineering, or Cyber Security Operations.
• Strong hands-on experience with Microsoft Sentinel, Microsoft Defender XDR, and Azure security technologies.
• Proven expertise in managing SIEM/SOAR platforms, log management, detection engineering support, and security tooling integrations.
• Strong knowledge of KQL (Kusto Query Language), PowerShell, and Python scripting for automation and operational efficiency.
• Experience with log collection technologies, including Syslog, WEF, Azure Monitor Agent (AMA), Event Hub, and custom integrations.
• Hands-on experience with Logstash, Cribl, or similar telemetry and data pipeline technologies.
• Familiarity with Azure DevOps, Git, CI/CD practices, and Infrastructure-as-Code methodologies.
• Experience implementing and supporting Azure Logic Apps, Azure Functions, and SOAR platforms such as Cortex XSOAR.
• Strong troubleshooting, incident management, and root cause analysis skills.
• Excellent communication and stakeholder management skills with the ability to work in a global, fast-paced security environment.

Responsibilities

• Manage, maintain, and optimize Security Operations Center (SOC) platforms, including SIEM, SOAR, and security analytics solutions.
• Administer and support Microsoft Sentinel, Microsoft Defender XDR, and Azure security services to ensure platform stability and performance.
• Design, implement, and maintain log ingestion pipelines using Syslog, Windows Event Forwarding (WEF), Azure Monitor Agent (AMA), Event Hub, and other data connectors.
• Monitor platform health, data flow, integrations, and performance, ensuring timely identification and resolution of issues.
• Develop and maintain automation workflows using Azure Logic Apps, Azure Functions, PowerShell, Python, and SOAR technologies.
• Perform platform upgrades, configuration management, patching, and troubleshooting activities across security monitoring infrastructure.
• Build and maintain CI/CD pipelines and Infrastructure-as-Code (IaC) solutions using Azure DevOps, Git, and automation frameworks.
• Support integration of security tools and technologies, including endpoint, network, cloud, and third-party security solutions.
• Create and optimize queries, dashboards, analytics rules, workbooks, and detection content using KQL.
• Collaborate with Detection Engineering, Threat Hunting, SOC Analysts, Incident Response, and Infrastructure teams to improve security operations.
• Ensure platform availability, scalability, reliability, and compliance with organizational security standards and best practices.
• Document platform configurations, operational procedures, troubleshooting guides, and architecture diagrams.

Skills

SIEM Engineering

SOC Engineering

Security Platform Eng

Cyber Security Ops

KQL

PowerShell

Python

Azure DevOps

Git

CI/CD

IaC

Azure Logic Apps

Azure Functions

SOAR

Cortex XSOAR

Incident Management

Log Management

Syslog

WEF

Azure Monitor Agent

Microsoft Sentinel

Microsoft Defender XDR

Event Hub

Cribl

Logstash

Tools

Cribl

Logstash

Syslog

WEF

Azure Monitor Agent

Event Hub

Azure DevOps

Job description

Role & responsibilities

• Manage, maintain, and optimize Security Operations Center (SOC) platforms, including SIEM, SOAR, and security analytics solutions.


• Administer and support Microsoft Sentinel, Microsoft Defender XDR, and Azure security services to ensure platform stability and performance.


• Design, implement, and maintain log ingestion pipelines using Syslog, Windows Event Forwarding (WEF), Azure Monitor Agent (AMA), Event Hub, and other data connectors.


• Monitor platform health, data flow, integrations, and performance, ensuring timely identification and resolution of issues.


• Develop and maintain automation workflows using Azure Logic Apps, Azure Functions, PowerShell, Python, and SOAR technologies.


• Perform platform upgrades, configuration management, patching, and troubleshooting activities across security monitoring infrastructure.


• Build and maintain CI/CD pipelines and Infrastructure-as-Code (IaC) solutions using Azure DevOps, Git, and automation frameworks.


• Support integration of security tools and technologies, including endpoint, network, cloud, and third-party security solutions.


• Create and optimize queries, dashboards, analytics rules, workbooks, and detection content using KQL.


• Collaborate with Detection Engineering, Threat Hunting, SOC Analysts, Incident Response, and Infrastructure teams to improve security operations.


• Ensure platform availability, scalability, reliability, and compliance with organizational security standards and best practices.


• Document platform configurations, operational procedures, troubleshooting guides, and architecture diagrams.

Preferred Candidate Profile

• 5+ years of experience in SIEM Engineering, SOC Engineering, Security Platform Engineering, or Cyber Security Operations.


• Strong hands-on experience with Microsoft Sentinel, Microsoft Defender XDR, and Azure security technologies.


• Proven expertise in managing SIEM/SOAR platforms, log management, detection engineering support, and security tooling integrations.


• Strong knowledge of KQL (Kusto Query Language), PowerShell, and Python scripting for automation and operational efficiency.


• Experience with log collection technologies, including Syslog, WEF, Azure Monitor Agent (AMA), Event Hub, and custom integrations.


• Hands-on experience with Logstash, Cribl, or similar telemetry and data pipeline technologies.


• Familiarity with Azure DevOps, Git, CI/CD practices, and Infrastructure-as-Code methodologies.


• Experience implementing and supporting Azure Logic Apps, Azure Functions, and SOAR platforms such as Cortex XSOAR.


• Strong troubleshooting, incident management, and root cause analysis skills.


• Excellent communication and stakeholder management skills with the ability to work in a global, fast-paced security environment.