Lead Security Engineer

HireFlex; India; On-site; INR 2,400,000 - 3,800,000; Full time

Job summary

HireFlex is seeking a Senior Security Engineer to drive technical qualification, design secure telemetry pipelines, and optimize SIEM integrations across cloud and on-prem environments. You will mentor junior engineers and partner with Security Engineering, Threat Monitoring, and platform teams to ensure scalable, cost-efficient security telemetry solutions.

You will shape Data Collection Rules, parsers, and schema mappings while advancing ASIM normalization and reference architectures.

Qualifications

• 8+ years of experience in Security Engineering, Security Operations Engineering, SIEM Engineering, Cloud Security, or a related discipline.
• Advanced Microsoft Azure experience, including Entra ID, Azure Networking, Log Analytics, Azure Monitor, Key Vault, and RBAC.
• Advanced knowledge of Kusto Query Language (KQL) and detection engineering.
• Experience with telemetry volume estimation, retention planning, and SIEM cost optimization.

Responsibilities

• Lead technical qualification of new SIEM onboarding requests, integrations, and security telemetry requirements.
• Assess solution architecture, security controls, authentication methods, connectivity, network dependencies, and access requirements.
• Design and review log onboarding patterns, telemetry pipelines, and SIEM integration architectures.
• Define and implement Data Collection Rules (DCRs), parsers, transformations, normalization, and schema mappings.
• Support adoption of Advanced Security Information Model (ASIM) normalization standards where applicable.
• Design scalable and reusable ingestion patterns across cloud, on-premises, Linux, container, and third-party platforms.
• Develop and review KQL queries, analytics rules, detections, hunting queries, and SIEM use cases.
• Troubleshoot complex issues related to collection, ingestion, parsing, connectivity, authentication, and data quality.
• Validate integrations through functional, security, performance, and operational testing.
• Develop reusable engineering standards, onboarding templates, reference architectures, automation, and technical accelerators.
• Collaborate with Security Engineering, Threat Monitoring, T&I; teams, application teams, and platform owners.
• Review technical designs for alignment with security, architecture, and operational standards.
• Drive continuous improvement of telemetry quality, coverage, performance, and cost efficiency.
• Mentor junior engineers and provide technical oversight during onboarding and troubleshooting activities.
• Maintain high-quality engineering documentation, technical decision records, runbooks, and implementation standards.

Skills

Security engineering

SIEM engineering

Cloud security

KQL

Analytical skills

Troubleshooting

Mentoring

CI/CD

Education

Microsoft Azure certifications

Cybersecurity certifications

Tools

Azure Monitor

Log Analytics

Key Vault

Splunk

IBM QRadar

Elastic Security

Job description

We are seeking a Senior Security Engineer to support the Engineering Qualification operating model, with responsibility for the technical assessment, design, onboarding, validation, and optimization of security telemetry, cloud integrations, and SIEM use cases. The role will work closely with Security Engineering, Threat Monitoring, Technology & Infrastructure teams, platform owners, and other stakeholders to ensure integrations are secure, scalable, supportable, and cost-effective. The engineer will also provide technical leadership and mentor junior team members.

Key Responsibilities

• Lead technical qualification of new SIEM onboarding requests, integrations, and security telemetry requirements.
• Assess solution architecture, security controls, authentication methods, connectivity, network dependencies, and access requirements.
• Design and review log onboarding patterns, telemetry pipelines, and SIEM integration architectures.
• Define and implement Data Collection Rules (DCRs), parsers, transformations, normalization, and schema mappings.
• Support adoption of Advanced Security Information Model (ASIM) normalization standards where applicable.
• Estimate telemetry volumes and assess ingestion, storage, retention, and operational cost implications.
• Design scalable and reusable ingestion patterns across cloud, on-premises, Linux, container, and third‑party platforms.
• Develop and review KQL queries, analytics rules, detections, hunting queries, and SIEM use cases.
• Troubleshoot complex issues related to collection, ingestion, parsing, connectivity, authentication, and data quality.
• Validate integrations through functional, security, performance, and operational testing.
• Develop reusable engineering standards, onboarding templates, reference architectures, automation, and technical accelerators.
• Collaborate with Security Engineering, Threat Monitoring, T&I; teams, application teams, and platform owners.
• Review technical designs for alignment with security, architecture, and operational standards.
• Drive continuous improvement of telemetry quality, coverage, performance, and cost efficiency.
• Mentor junior engineers and provide technical oversight during onboarding and troubleshooting activities.
• Maintain high‑quality engineering documentation, technical decision records, runbooks, and implementation standards.

Required Experience & Skills

• 8+ years of experience in Security Engineering, Security Operations Engineering, SIEM Engineering, Cloud Security, or a related discipline.
• Advanced Microsoft Azure experience, including Entra ID, Azure Networking, Log Analytics, Azure Monitor, Key Vault, and RBAC.
• Advanced experience with Microsoft Sentinel preferred; strong experience with another enterprise SIEM may be considered.
• Advanced knowledge of Kusto Query Language (KQL) and detection engineering.
• Strong hands‑on knowledge of log ingestion, parsing, normalization, enrichment, and schema design
• Experience with Azure Monitor Agent (AMA), Syslog, Logstash, Fluent Bit, Beats, or equivalent collection technologies.
• Experience designing and maintaining Data Collection Rules (DCRs) and telemetry pipelines.
• Strong understanding of security architecture, identity, authentication, network security, and secure integration patterns.
• Experience with telemetry volume estimation, retention planning, and SIEM cost optimization.
• Good working knowledge of Linux and container platforms.
• Experience with Git‑based workflows and CI/CD practices.
• Demonstrated ability to troubleshoot complex integration and telemetry issues.
• Experience mentoring or technically guiding junior engineers.
• Experience with Splunk, IBM QRadar, Elastic Security, or other enterprise SIEM platforms.
• Experience with infrastructure‑as‑code and automation technologies such as Terraform, Bicep, Azure DevOps, or GitHub Actions.
• Experience developing detections mapped to MITRE ATT&CK; or equivalent frameworks.
• Knowledge of cloud‑native security monitoring and multi‑cloud telemetry architectures.
• Relevant Microsoft, Azure, SIEM, or cybersecurity certifications.
• Strong security engineering and architectural judgement.
• Ability to translate monitoring requirements into scalable technical solutions.
• Strong analytical, troubleshooting, and root‑cause analysis capability.
• Ability to assess technical risk, operational impact, and cost implications.
• Strong written and verbal communication skills across technical and non‑technical stakeholders.
• Ability to independently lead complex engineering activities from qualification through production onboarding.