Security Engineer

Artech L.L.C.; Ernakulam; On-site; INR 300,000 - 600,000; Full time

Job summary

Security Engineer role focused on SIEM & SOAR platforms, with hands-on engineering across Google Chronicle, Splunk, and related telemetry pipelines.

The role emphasizes threat hunting, detection-as-code (YARA-L, Sigma, Python), incident response automation, and CI/CD integration to keep security controls scalable and auditable across multi-cloud and on-prem environments.

Qualifications

• 7–12 years of hands-on SIEM/SOAR platform engineering experience.
• Proficiency in detection engineering using YARA-L, Sigma, SPL, or KQL.
• Extensive knowledge of MITRE ATT&CK, threat hunting, and incident response automation.

Responsibilities

• SIEM & Security Analytics Engineering: Deep hands-on experience designing, scaling, and operating enterprise next-gen SIEM platforms (Google SecOps / Chronicle, Splunk, Microsoft Sentinel), including data parsing, UDM mapping, indexing, and high-performance search optimization.
• Detection Engineering & Detection-as-Code: Authoring, testing, and operationalising threat detection rules using YARA-L, Sigma, SPL, or KQL, with CI/CD for detection lifecycles (version control, automated validation, testing harnesses).
• SOAR Automation & Orchestration: Building automated incident triage, investigation, and response playbooks using modern SOAR platforms (Google SecOps SOAR / Siemplify, Splunk SOAR / Phantom, Cortex XSOAR), utilizing custom Python scripts and REST API integrations.
• Proactive Threat Hunting: Hypothesis-driven and behavioral hunts across multi-cloud (GCP / Azure / AWS) and on-premises estates to identify APTs and evasive adversaries.
• Security Telemetry Ingestion & Parsing: Configuring and optimizing log collectors and telemetry pipelines (BindPlane, OpenTelemetry, Logstash, Fluentbit, Cloud Pub/Sub), ensuring schema normalization and data integrity.

Skills

SIEM Engineering

Detection Engineering

SOAR Automation

Threat Hunting

Python

CI/CD for security

MITRE ATT&CK

Data parsing

Cloud security

Tools

Splunk

Chronicle

Google SecOps

Siemplify

Cortex XSOAR

Job description

Role

Security Engineer (Detection & Response / SIEM & SOAR)

Required Technical Skill Set

SIEM Engineering (Google SecOps / Chronicle / Splunk), Detection Engineering & Detection-as-Code (YARA-L / Sigma / Python), SOAR Automation & Playbook Development, Threat Hunting (Hypothesis-Driven & Behavioral Hunting), Security Telemetry Integration (BindPlane, OpenTelemetry, Logstash, Syslog, Cloud Logs), Secure CI/CD Pipelines (GitHub Actions / GitLab CI), MITRE ATT&CK Mapping

Desired Experience Range

7 - 12 Years (with strong focus on SIEM/SOAR platform engineering, detection engineering, threat hunting, and incident response automation)

Role Descriptions

• SIEM & Security Analytics Engineering: Deep hands-on experience designing, scaling, and operating enterprise next-gen SIEM platforms (Google SecOps / Chronicle, Splunk, Microsoft Sentinel), including data parsing, UDM mapping, indexing, and high-performance search optimization.
• Detection Engineering & Detection-as-Code: Proven track record authoring, testing, and operationalising threat detection rules using YARA-L, Sigma, SPL, or KQL. Practical experience applying DevOps/CI-CD principles to detection lifecycles (version control, automated validation, testing harnesses, and promotion).
• SOAR Automation & Orchestration: Advanced experience building automated incident triage, investigation, and response playbooks using modern SOAR platforms (Google SecOps SOAR / Siemplify, Splunk SOAR / Phantom, Cortex XSOAR), utilizing custom Python scripts and REST API integrations.
• Proactive Threat Hunting: Strong capability in conducting hypothesis-driven and behavioral threat hunts across multi-cloud (GCP / Azure / AWS) and on-premises estates to identify advanced persistent threats (APTs) and evasive adversaries bypassing signature-based alerts.
• Security Telemetry Ingestion & Parsing: Practical experience configuring and optimizing log collectors and telemetry pipelines (BindPlane OP, OpenTelemetry Collector, Logstash, Fluentbit, Cloud Pub/Sub, Event Hubs), ensuring schema normalization and audit data integrity.
• Threat Frameworks & Contextual Enrichment: Extensive knowledge of MITRE ATT&CK, D3FEND, and Cyber Kill Chain frameworks to map detection coverage, evaluate visibility gaps, and enrich security signals with threat intelligence (GTI, STIX/TAXII).
• Scripting & CI/CD Tooling: High proficiency in Python for security automation, combined with hands-on experience utilizing Git, GitHub Actions, or GitLab CI for managing security infrastructure and detection repositories.