Security Engineer III - IN

Rackspace US, Inc.; India; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

Rackspace Cyber Defence in India seeks an senior SIEM specialist to lead administration and optimization of Elastic SIEM and Microsoft Sentinel. You will onboard cloud and on-prem data, build dashboards and rules, and craft customer-specific use cases and playbooks.

You’ll coordinate with vendors, support incident response, and drive security telemetry integration across multi-cloud environments. You will own end-to-end SIEM operations, ensure reliable data ingestion, and collaborate with

Qualifications

• 8+ years of relevant experience.
• Proven experience administering, configuring, and supporting Microsoft Sentinel and Elastic Security (Elastic SIEM) in large-scale cloud and enterprise environments, with the ability to independently manage SIEM operations, onboarding, integrations, and troubleshooting.
• Experience in Cloud Security Monitoring across Microsoft Azure, Microsoft 365, GCP and AWS within Elastic Security.
• Experience onboarding and analyzing security telemetry from Microsoft Defender XDR, Defender for Endpoint, Defender for Cloud, and Defender for Office 365.
• Experience integrating and monitoring endpoint security events from CrowdStrike and Defender for Endpoint.
• Experience onboarding and troubleshooting security logs from network and web security platforms (firewalls, WAFs).
• Ability to own the Elastic Security platform end-to-end, from deployment to ongoing maintenance and optimization.

Responsibilities

• Assist with customer onboarding by configuring and integrating data feeds into SIEM platforms with primary focus on Microsoft Sentinel and Elastic Security.
• Onboard and integrate on-premises and cloud resources into Elastic SIEM and MS Sentinel, ensuring reliable data ingestion, parsing, and monitoring.
• Develop custom dashboards and reporting templates to meet customer needs.
• Create complex, customer-specific use cases and playbooks; enhance workflows.
• Coordinate with vendors for issue resolution and drive platform optimization.
• Maintain strong relationships with incident response, disaster recovery, and information security teams.

Tools

Elastic SIEM

Microsoft Sentinel

Elasticsearch

Kibana

Logstash

Data ingestion

Detection rules

Dashboards

Incident investigation

Azure

AWS

GCP

Defender XDR

EDR

Palo Alto

Fortinet

Juniper

Cisco

Cloudflare WAF

Akamai

Job description

About Rackspace Cyber Defence

Rackspace Cyber Defence is our next generation cyber defence and security operations capability that builds on 20+ years of securing customer environments to deliver proactive, risk-based, threat-informed and intelligence driven security services.

Our purpose is to enable our customers to defend against the evolving threat landscape across on-premises, private cloud, public cloud and multi-cloud workloads.

Our goal is to go beyond traditional security controls to deliver cloud-native, DevOps-centric and fully integrated 24x7x365 cyber defence capabilities that deliver a proactive , threat-informed , risk-based , intelligence-driven approach to detecting and responding to threats.

Our mission is to help our customers:

• Proactively detect and respond to cyber-attacks - 24x7x365.
• Defend against new and emerging risks that impact their business.
• Reduce their attack surface across private cloud, hybrid cloud, public cloud, and multi-cloud environments.
• Reduce their exposure to risks that impact their identity and brand.
• Develop operational resilience.
• Maintain compliance with legal, regulatory and compliance obligations.

Key Accountabilities

• Assist with customer onboarding by configuring and integrating data feeds into SIEM platforms with primary focus on Microsoft Sentinel and Elastic Security. Good to have experience in Splunk, IBM QRadar, and Google SecOps (Chronicle)
• Ensure the Customer's operational and production environment remains healthy and secure at all the times.
• Onboard and integrate on-premises and cloud resources into Elastic SIEM, MS Sentinel, ensuring reliable security log ingestion, parsing, and monitoring.
• Develop custom dashboards and reporting templates.
• Develop complex to customer specific use cases.
• Advance platform administration, ideally through a DevOps-centric approach.
• Solution recommendation for issues.
• Co-ordinate with vendor for issue resolution.
• Basic and Intermediate Playbook and workflow enhancement.
• Maintain close working relationships with relevant teams and individual key stakeholders, such as incident response and disaster recovery teams as well as information security etc.
• Develop the custom parsers for the Incident and alert enrichment.
• Problem specific playbook and workflow creation and enhancements - Required to work flexible timings.

Skills & Experience

Should have relevant experience of 8+ years.

• Proven experience in administering, configuring, and supporting Microsoft Sentinel and Elastic Security (Elastic SIEM) in large-scale cloud and enterprise environments, with the ability to independently manage SIEM operations, onboarding, integrations, and troubleshooting.
• Elastic SIEM / Elastic Security (mandatory): Strong hands-on expertise in Elasticsearch, Kibana, Elastic Agent, Fleet, Logstash, data ingestion, integration management, parsing, ECS normalization, detection rules, alerts, dashboards, and incident investigation.
• Cloud Security Monitoring: Experience integrating and monitoring security logs from Microsoft Azure, Microsoft 365, GCP and AWS environments within Elastic Security.
• Microsoft Security Integration: Experience onboarding and analyzing security telemetry from Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Defender for Cloud, and Microsoft Defender for Office 365.
• Endpoint Detection & Response (EDR): Experience integrating and monitoring endpoint security events from solutions such as CrowdStrike and Microsoft Defender for Endpoint.
• Network Security Integration: Experience onboarding and troubleshooting security logs from firewalls and network security platforms, including Palo Alto, Fortinet, Juniper, and Cisco.
• Web Application Firewall (WAF): Experience integrating and monitoring WAF logs from Cloudflare, Akamai, and Azure WAF.
• Email Security: Experience integrating and analyzing email security telemetry from Proofpoint, Mimecast, and Microsoft Defender for Office 365.
• Data Loss Prevention (DLP): Experience integrating and monitoring DLP events from Microsoft Purview, McAfee, and Symantec solutions.
• AWS Security Monitoring: Experience onboarding and analyzing AWS security logs and findings from AWS Security Hub, GuardDuty, Macie, AWS Config, and CloudTrail.
• Experience integration GCP logs into SIEM tools.
• SIEM Administration & Troubleshooting: Ability to independently troubleshoot ingestion failures, parsing issues, integration errors, agent health, data gaps, and performance problems, and to optimize data ingestion, retention, and storage.
• Detection Engineering & Operations: Experience developing and maintaining detection rules, alerting workflows, dashboards, and investigation queries to support SOC monitoring and incident response.
• Independent Ownership: Ability to take end-to-end ownership of the Elastic Security platform, from initial deployment and data source onboarding through ongoing administration, maintenance, optimizat