Lead Cyber Security Engineer – SIEM & Detection Engineering

Staples India; Chennai; Presencial; INR 3.500.000 - 6.500.000; Jornada completa

Descripción de la vacante

Staples India is seeking a Lead Cyber Security Engineer – SIEM & Detection Engineering to own enterprise security monitoring, detection logic, and telemetry pipelines. You will lead SIEM architecture, develop advanced detections, and mentor analysts while coordinating with SOC/IR teams.

You will engineer Cribl Stream/Edge, optimize ingestion, and steer cost-effective log management to improve visibility and response across endpoints, networks, cloud, and identities.

Formación

• Solid understanding of network protocols and threat landscapes.
• Hands-on experience with security systems including firewalls, IDS, antivirus.

Responsabilidades

• Architect and optimize SIEM platforms (e.g., MS Sentinel, Splunk) including ingestion and parsing.
• Engineer Cribl Stream and Cribl Edge for routing, enrichment, and data reduction.
• Design telemetry onboarding with collectors and connectors across sources.
• Develop detections aligned to MITRE ATT&CK and evolving threats; measure coverage.
• Lead alert tuning to reduce false positives and improve signal quality.
• Build dashboards and hunting queries to accelerate SOC investigations.

Conocimientos

KQL/SPL

Cribl Stream

Cribl Edge

SIEM tuning

MITRE ATT&CK

Threat detection

Telemetry pipelines

Educación

CISSP

CISM

CEH

Master’s degree in Cybersecurity

Herramientas

Microsoft Sentinel

Splunk

Cribl Stream

Cribl Edge

Descripción del empleo

The Lead Cyber Security Engineer – SIEM & Detection Engineering is the primary technical owner for enterprise security monitoring, detection logic, and telemetry pipelines. This role architects and optimizes the SIEM platform, designs detection use cases across endpoint, network, identity, cloud, and application layers, and ensures reliable, cost-efficient log ingestion and normalization. A core responsibility is engineering and operating Cribl Stream and Cribl Edge to route, filter, enrich, and transform security telemetry at scale—improving SIEM visibility, data quality, performance, and cost management. The Lead Engineer partners with SOC/IR, Threat Hunting, Identity, Cloud, Network, and Application teams to raise detection fidelity, reduce false positives, and accelerate investigations. The role drives the detection engineering roadmap, mentors junior staff, and maintains a robust observability ecosystem aligned to threat intelligence and MITRE ATT&CK.

Duties & Responsibilities

• · Architect and optimize SIEM platforms (e.g., Microsoft Sentinel, Splunk), including ingestion pipelines, parsing/normalization, enrichment, and correlation logic.
• · Engineer and operate Cribl Stream and Cribl Edge for log routing, filtering, transformation, enrichment, data reduction, and destination fan-out (SIEM, data lake, cold storage).
• · Design and maintain telemetry onboarding with schema mapping, collectors/agents, connectors, API integrations, replay, and edge collection for diverse sources (endpoint, network, cloud, identity, app).
• · Develop advanced detections and analytics (rules, queries, correlations) aligned to MITRE ATT&CK, emerging TTPs, and threat intelligence; measure detection efficacy and coverage.
• · Lead systematic alert tuning to reduce false positives and improve signal-to-noise, leveraging Cribl pipelines and SIEM analytics to standardize high-fidelity events.
• · Build investigation assets (dashboards, hunting queries, data models) that accelerate SOC workflows and root-cause analysis across telemetry domains.
• · Monitor ingestion health and cost (EPS/GB/day, license utilization), implement Cribl-based data controls (sampling, routing, suppression) to ensure reliability and budget adherence.
• · Perform RCA on detection gaps and pipeline failures; implement durable fixes in Cribl routes/pipelines and SIEM parsing/enrichment layers.
• · Mentor engineers and analysts on KQL/SPL, detection engineering patterns, Cribl pipeline design, and telemetry best practices; conduct peer reviews and standards governance.
• · Maintain documentation: data dictionaries, detection catalogs, Cribl pipeline/runbooks, ingestion maps, and metrics reporting on coverage, fidelity, MTTR, and pipeline SLOs.

Basic Qualifications

• · Solid understanding of network protocols, data protection mechanisms, and threat landscapes
• · Hands-on experience with security systems, including firewalls, intrusion detection systems, anti-virus software, etc.

Preferred Qualifications

• · Industry-recognized certifications (e.g., CISSP, CISM, CEH)
• · Master’s degree in Cybersecurity or a related field