Security Data & SIEM Engineer

Johnson Controls; Bengaluru; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

Johnson Controls is seeking a Security Data & SIEM Engineer to enhance security visibility across cloud and enterprise environments. You will own key parts of the security data pipeline, including log onboarding, normalization, detection content, alert tuning, and integrations with operational workflows.

This hands-on role requires collaboration with threat detection, incident response, and platform teams to improve telemetry quality and drive reliable detections.

Qualifications

• Bachelor's degree in computer science, information security, engineering, or a related field, or equivalent experience.
• 5 to 10 years of experience in IT security, security operations, or security engineering.
• Hands-on experience with SIEM platforms such as Splunk, QRadar, ArcSight, or Logscale.
• Strong understanding of log management, detection engineering, alert tuning, and security event analysis.
• Experience onboarding and maintaining security telemetry from cloud, endpoint, network, identity, and application sources.
• Experience with vulnerability management tools such as Qualys, Tenable.io, or Rapid7.
• Experience with endpoint protection solutions such as CrowdStrike, Carbon Black, or SentinelOne.
• Experience with CSPM tools such as Palo Alto Prisma, CrowdStrike CSPM, or Sophos Cloud Optix.
• Working knowledge of ServiceNow, Jira, or similar ticketing workflows.
• Strong troubleshooting, documentation, and communication skills.

Responsibilities

• Configure and maintain SIEM content, including log sources, parsing, correlation rules, dashboards, alerts, and reports.
• Ingest and normalize security events from cloud, endpoint, network, identity, and application sources.
• Tune detections to reduce noise, improve signal quality, and support timely response.
• Support security tooling across SIEM, vulnerability management, endpoint protection, and CSPM platforms.
• Integrate security alerts and workflows with ServiceNow, Jira, and related ticketing tools.
• Partner with threat detection, incident response, and platform teams to investigate events and improve coverage.
• Maintain documentation, runbooks, policies, and procedures for security tooling and integrations.
• Monitor tool health and data quality, and troubleshoot issues in ingestion, visibility, and alerting.
• Stay current on emerging threats, vulnerabilities, and security best practices.
• Mentor team members and share practical guidance on SIEM engineering and data analysis.

Skills

Log analysis

Alert tuning

Threat detection

Incident response

Scripting (Python/PowerShell)

Education

Bachelor's degree in computer science / information security / engineering

Tools

Splunk

QRadar

ArcSight

Logscale

Qualys

Tenable.io

Rapid7

CrowdStrike

Prisma Cloud

Job description

Job description: Security Data & SIEM Engineer Johnson Controls is looking for a Security Data & SIEM Engineer to strengthen security visibility across cloud and enterprise environments. In this role, you will help design, tune, and operate the security logging and SIEM capabilities that support threat detection, investigation, and response.

Role Overview You will own key parts of the security data pipeline, including log onboarding, normalization, detection content, alert tuning, and integrations with operational workflows. This is a hands-on engineering role for someone who can work across security tooling, incident response, and cross-functional partners to improve the quality and usefulness of security telemetry.

Key Responsibilities

• Configure and maintain SIEM content, including log sources, parsing, correlation rules, dashboards, alerts, and reports.
• Ingest and normalize security events from cloud, endpoint, network, identity, and application sources.
• Tune detections to reduce noise, improve signal quality, and support timely response.
• Support security tooling across SIEM, vulnerability management, endpoint protection, and CSPM platforms.
• Integrate security alerts and workflows with ServiceNow, Jira, and related ticketing tools.
• Partner with threat detection, incident response, and platform teams to investigate events and improve coverage.
• Maintain documentation, runbooks, policies, and procedures for security tooling and integrations.
• Monitor tool health and data quality, and troubleshoot issues in ingestion, visibility, and alerting.
• Stay current on emerging threats, vulnerabilities, and security best practices.
• Mentor team members and share practical guidance on SIEM engineering and data analysis.

How You Will Do It

You take ownership of security outcomes with accountability, integrity, and a strong focus on safe operations. You stay close to the work, remove friction for your customers, and focus on the logs, detections, and integrations that matter most. You use data, feedback, and root-cause analysis to improve detection quality and make the environment better every day. You collaborate across security, IT, and business teams, sharing knowledge and building trust to win as one team. You validate changes carefully, document your work clearly, and keep support teams informed so the environment remains reliable and easy to operate.

Qualifications

• Qualifications Bachelor's degree in computer science, information security, engineering, or a related field, or equivalent experience.
• 5 to 10 years of experience in IT security, security operations, or security engineering.
• Hands-on experience with SIEM platforms such as Splunk, QRadar, ArcSight, or Logscale.
• Strong understanding of log management, detection engineering, alert tuning, and security event analysis.
• Experience onboarding and maintaining security telemetry from cloud, endpoint, network, identity, and application sources.
• Experience with vulnerability management tools such as Qualys, Tenable.io, or Rapid7.
• Experience with endpoint protection solutions such as CrowdStrike, Carbon Black, or SentinelOne.
• Experience working with CSPM tools such as Palo Alto Prisma, CrowdStrike CSPM, or Sophos Cloud Optix.
• Working knowledge of ServiceNow, Jira, or similar ticketing workflows.
• Strong troubleshooting, documentation, and communication skills.
• Nice to Have Python or PowerShell scripting experience.
• Experience with Kubernetes security or cloud infrastructure security.
• Certifications such as CompTIA Security+, Splunk Certified User, Splunk Certified Power User, GSEC, CISSP, or CISM.
• Experience supporting SOAR or automation workflows.
• Familiarity with Linux, Windows, or macOS security data sources.

Johnson Controls: Enhancing the Intelligence of Buildings

Your buildings have a purpose. They are places for people to live or work. Facilities for learning or healing. Venues for entertainment and shopping. Sites for the specialized storage of tangible goods or mission-critical data. Your buildings have a huge variety of functions; they are central to your mission. This is where Johnson Controls comes in, helping drive the outcomes that matter most. Through a full range of systems and digital solutions, we make your buildings smarter. A smarter building is safer, more comfortable, more efficient, and, ultimately, more sustainable. Most important, smarter buildings let you focus more intensely on your unique mission. Better for your people. Better for your bottom line. Better for the planet.

At Johnson Controls, we’ve been making buildings smarter since 1885, and our capabilities, depth of innovation experience, and global reach have been growing ever since. Today, we offer the world’s largest portfolio of building products, technologies, software, and services; we put that portfolio to work to transform the environments where people live, work, learn and play.