Lead Security Engineer - Platform

Expleo; Chennai District; Remote; INR 2,600,000 - 4,200,000; Full time

Job summary

Expleo is seeking a Lead Security Engineer | Platform to act as SME for endpoint, application control, email and web-edge security. You will lead Network and Identity Security Engineers and deliver designs, analyses and assurance without live changes to client systems.

You will work as part of Expleo's offshore consultancy team, reporting into the UK Cybersecurity Practice, with changes implemented by UK-based personnel.

Qualifications

• Experience evaluating endpoint/XDR and SIEM platforms in enterprise security.
• Ability to produce design docs, baselines and change packages.
• Strong analytical skills and scripting for reporting.

Responsibilities

• Act as SME in endpoint protection and XDR, app allowlisting, email security gateways, and web-edge platforms.
• Define and maintain secure configuration baselines and hardening standards.
• Review platform configurations and recommend improvements.
• Design platform changes and prepare change packages for UK-based implementation.
• Assess application control requests and provide risk-based governance recommendations.
• Analyze platform reporting and produce monthly recommendations.
• Assess SIEM log coverage and recommend detection improvements.
• Track vendor end-of-life risks and upgrade plans.
• Provide forensic-readiness input to support UK SOC and incident response partner.
• Lead and supervise the Network and Identity Security Engineers.
• Support growth of Expleo's Cybersecurity Practice through knowledge sharing.

Skills

EDR/XDR

Anti-malware

Device control

Email security gateways

WAF/DDoS/DNS

SIEM onboarding

Design documentation

Incident response

Scripting for reporting

Education

Degree in CS/Cybersecurity

Certifications (GIAC/CompTIA)

Tools

Palo Alto Cortex XDR

Microsoft Defender

CrowdStrike

QRadar

Splunk

PowerShell

Python

KQL/AQL/SPL

Job description

Overview

Expleo is a trusted partner for end-to-end, integrated engineering, quality services, and management consulting for digital transformation. We help businesses harness technological change to deliver innovation, improve resilience, and support the secure delivery of complex products, platforms, and systems.

As part of the Expleo UK Cybersecurity Practice, you will join a managed Cyber Operations service for a major UK energy network operator that forms part of the UK's Critical National Infrastructure (CNI). The service is governed by Expleo in the UK, with a 24/7 UK Security Operations Centre delivered by a specialist partner and an Expleo consultancy team in India providing design, engineering and assurance expertise across the client's security tooling estate.

As Lead Security Engineer | Platform, you will be the subject matter expert for the client's endpoint, application control, email, and web-edge security platforms and will lead the Network and Identity Security Engineers.

This is a design, review and advisory role. You will work within Expleo's offshore consultancy team, outside the client's operational environment. You will not have access to the client's operational systems or data and will not make live changes. Operational changes are implemented by UK-based, security-cleared personnel; your work provides the designs, analysis, recommendations and assurance that those changes depend on. You will work from information released to the team through Expleo's controlled UK service boundary.

Responsibilities

• Act as a subject matter expert in endpoint protection and XDR, application allowlisting, email security gateways, and web-edge platforms (WAF, DDoS, and DNS).
• Define and maintain secure configuration baselines and hardening standards aligned to vendor best practices and client policy.
• Review platform configurations, using exports released through the UK service boundary, and recommend improvements.
• Design platform changes and prepare complete change packages, including implementation, test and back-out plans, for implementation by UK-based personnel.
• Assess application control exception and policy exclusion requests and provide risk-based recommendations for governance approval.
• Analyse platform reporting (endpoint coverage and drift, malware trends, email threat trends, application control activity) and produce monthly reports and recommendations.
• Assess the coverage of security log feeds in the client's retained SIEM against the logging design, and recommend corrective actions and improvements to detection use cases.
• Track vendor support lifecycles, identify end-of-support risk and produce upgrade plans.
• Provide platform expertise and forensic-readiness input (runbooks, evidence sources, playbooks) to support the UK SOC and incident response partner.
• Provide advisory support to incident management when requested, including during major incidents.
• Contribute platform content to monthly service reports and maintain platform diagrams and documentation.
• Lead, allocate and quality-review the work of the Network and Identity Security Engineers.
• Support the growth of Expleo's Cybersecurity Practice through knowledge sharing, technical contribution and client-facing delivery excellence.

Qualifications

• Degree in computer science, cybersecurity or a related discipline, or equivalent professional experience.
• Vendor certification in at least one enterprise endpoint/XDR or SIEM platform (e.g. Palo Alto Cortex, Microsoft SC-200, CrowdStrike, IBM QRadar, Splunk).
• GIAC GCIH/GCIA, CompTIA CySA+ or ITIL 4 Foundation would be advantageous.

Essential skills

• Strong knowledge of EDR/XDR and anti-malware platforms (e.g. Palo Alto Cortex XDR, Microsoft Defender, CrowdStrike, Trellix).
• Application allowlisting and device control (e.g. Carbon Black App Control, Airlock Digital, WDAC).
• Email security gateways (e.g. Cisco Secure Email, Proofpoint, Mimecast).
• Web application firewall, DDoS and DNS protection services (e.g. F5, Cloudflare, Akamai).
• Understanding of SIEM log onboarding and detection use cases (e.g. QRadar, Splunk, Sentinel).
• Producing secure configuration baselines, design documentation and change packages.
• Incident response lifecycle (NIST SP 800-61) and ITIL change and incident management.
• Scripting and data analysis (PowerShell, Python, KQL, AQL or SPL) for reporting.

Desired skills

• Digital forensics and forensic-readiness experience (e.g. EnCase, FTK, Magnet AXIOM) and chain-of-custody practice.
• Energy, utilities or other CNI sector experience.
• Awareness of OT security constraints.

Experience

• 10-12 years in security engineering or operations, including 3+ years in a lead role across endpoint, gateway and logging platforms.
• Experience leading and quality-reviewing the work of other engineers.
• Experience supporting managed security services in regulated or CNI environments.