Lead Engineer - SIEM & Detection Platforms

AstraZeneca; India; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

AstraZeneca in Chennai seeks a Lead Engineer for SIEM and Detection Platforms to design, implement, and lead enterprise-grade detections across SIEM, EDR, NDR and cloud services.

You will own detection content, mentor teams, and drive automation to improve signal quality while reducing false positives, with collaboration across SOC, IR, and threat intelligence functions.

Qualifications

• Bachelor's degree in information security, computer science, or related field; equivalent experience accepted.
• At least five years in detection engineering or SOC roles with enterprise-scale impact.
• Experience mapping detections to MITRE ATT&CK and other frameworks.

Responsibilities

• Lead end-to-end detection engineering initiatives across SIEM, EDR, NDR, and cloud services.
• Develop, validate, and govern detection content with measurable outcomes.
• Balance sensitivity and efficiency to reduce false positives and alert fatigue.
• Coordinate with SOC, IR, and threat analysis teams to close coverage gaps.
• Scale detection techniques using automation, scripting, and detection-as-code.
• Define standards and quality controls for repeatable detection development.
• Collaborate with vendors and external partners for platform validation.

Skills

Detection engineering

Threat modelling

Scripting (Python/PowerShell)

Leadership

Enterprise security operations

Education

Bachelor's degree in information security or computer science

Tools

SIEM

EDR

NDR

Cloud-native security services

Sigma rules

YARA

Job description

Job Title: Lead Engineer - SIEM & Detection Platforms

GCL:E

Introduction to role:

Are you ready to build and lead enterprise-grade detections that stop real attacks before they impact patients and critical operations? As Lead Engineer for SIEM and Detection Platforms in Chennai, you will develop methods to identify, investigate, and neutralize threats. These threats span cloud services, local infrastructure, and OT/ICS environments. Your work will enable our teams to move faster and more safely as we deliver life-changing medicines.

Accountabilities:

• Detection Strategy and Leadership: Lead end-to-end detection engineering initiatives spanning threat coverage, crafting detection algorithms, and efficacy validation across SIEM, EDR, NDR, and cloud-native services; ensure focus on the most significant threats and measurable outcomes.
• Apply detailed approaches to detection engineering to improve defensive posture, reduce false positives, and accelerate threat identification. Adapt proven strategies to our enterprise context.
• Enterprise Detection Content Ownership: Build, optimise, and govern the organization's detection content library, mapping coverage to adversary tactics, techniques, and procedures using frameworks such as MITRE ATT&CK.
• Platform Excellence and Tuning: Drive performance optimisation related to detection mechanisms and platform queries; balance sensitivity with operational efficiency to increase signal quality and reduce alert fatigue.
• Provide technical oversight to external suppliers and platform vendors. Coordinate with SOC, incident response, and cyber threat analysis teams to validate efficiency and close coverage gaps.
• Proactive Coverage Management: Continuously assess the evolving threat landscape, identify detection gaps, and drive systematic development of new detections to address emerging techniques across technology domains.
• Innovation and Automation: Introduce and scale new detection techniques including behavioural analytics and machine learning approaches; champion detection-as-code, scripting, and orchestration to automate quality and deployment.
• Standards and Quality Frameworks: Define detection engineering standards, development methodologies, and quality controls; ensure repeatability, portability, and maintainability of detection logic.
• Purple Teaming and Validation: Partner with offensive security to emulate adversaries and validate detections; convert lessons learned into stronger coverage and faster time-to-detect.
• Continuous Improvement and Metrics: Establish measurable benchmarks for coverage, fidelity, and time-to-detect; lead tuning and improvement cycles that demonstrably reduce false positives and improve precision.

Essential Skills/Experience:

• Education: Bachelor's degree in information security, computer science, or a related field, or equivalent experience.
• Technical expertise: At least five years of experience in detection engineering. Preferably, this is within security operations centres or detection engineering teams. Proven success leading detection initiatives and applying innovative ways at enterprise scale.
• Detection engineering fundamentals: Deep expertise in detection logic design, threat modelling, and coverage mapping; extensive experience developing detections across diverse platforms and environments for enterprise-scale operations.
• Threat detection frameworks: Comprehensive familiarity with MITRE ATT&CK, Cyber Kill Chain, and detection engineering methodologies; understanding of how adversary techniques manifest across technology domains and how detection logic must be adapted.
• Detection platforms and tooling: At least five years of hands-on experience with enterprise detection platforms, including SIEM, EDR, NDR, and cloud-native security services; advanced proficiency in platform‑specific query languages, rule formats, and detection logic development.
• Threat intelligence integration: Working knowledge of how threat intelligence is consumed and translated into actionable detection logic; understanding of indicator types, threat actor TTPs, and detection prioritisation based on AstraZeneca's threat profile.
• Scripting and automation: At least three years of experience using scripting languages such as Python, PowerShell, or similar for detection logic development and automation; experience with detection-as-code practices and version control for detection content.
• Detection formats and standards: At least three years of experience with standardised detection formats, including Sigma rules, YARA signatures, and platform‑specific query languages; ability to develop por