Senior Security Engineer

UST; Bengaluru; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

UST is seeking a hands-on Senior Security Engineer to onboard environments into our SOC, build and tune detection use cases, and keep our SIEM and data pipelines healthy. You will work across Splunk, Microsoft Sentinel and Cribl, collaborating with SOC, Detection and Platform teams.

The role emphasizes strong detection engineering, log parsing, and data pipeline management, with collaboration across SOC and Platform teams to ensure audit-ready documentation and robust security operations.

Qualifications

• Bachelor’s degree in CS/IT or Information Security.
• Strong use-case building and detection tuning aligned with MITRE ATT&CK.
• Hands-on with Splunk and Microsoft Sentinel across SOC operations.

Responsibilities

• Onboard environments into SOC operations and ensure SIEM health.
• Design, test and tune MITRE ATT&CK-aligned detection use cases.
• Parse, normalise and enrich logs for search and detection.
• Manage data pipelines using Cribl Stream/Edge to optimise ingestion.
• Maintain dashboards, connectors, and platform health across Splunk and Sentinel.
• Collaborate and document with SOC, CTI and Platform teams.

Skills

MITRE ATT&CK

Splunk SPL

Microsoft Sentinel

Cribl data pipelines

Python

PowerShell

EDR

DLP

Education

Bachelor’s degree in Computer Science / IT / Information Security

Tools

Cribl Stream

Cribl Edge

Splunk

Microsoft Sentinel

KQL

Python

PowerShell

Job description

Role Description

About the Role Hands‑on Senior Security Engineer to onboard environments into our SOC, build and tune detection use cases, and keep our SIEM and data pipelines healthy. You will work across Splunk, Microsoft Sentinel and Cribl, and collaborate with the SOC, Detection and Platform teams.

Role Description

About the Role Hands‑on Senior Security Engineer to onboard environments into our SOC, build and tune detection use cases, and keep our SIEM and data pipelines healthy. You will work across Splunk, Microsoft Sentinel and Cribl, and collaborate with the SOC, Detection and Platform teams.

Key Responsibilities

• SOC-to-SIEM onboarding – integrate SIEM, EDR, IAM and DLP log sources into stable SOC operations.
• Detection engineering – design, test and tune MITRE ATT&CK-aligned use cases to improve fidelity and reduce false positives.
• Log parsing and normalisation – parse, normalise (CIM/ASIM) and enrich raw logs so they are ready for search and detection.
• Data pipeline management – use Cribl Stream/Edge to route, filter and enrich data while reducing ingestion noise and cost.
• Platform health – maintain Splunk and Sentinel health, tuning, dashboards and new data connector onboarding.
• Collaboration and documentation – partner with SOC, CTI and Platform teams while maintaining clear, audit‑ready documentation.

What You Bring

• Strong use case building and detection tuning skills (MITRE ATT&CK).
• Solid log parsing and normalisation experience.
• Hands‑on with Splunk (SPL) and Microsoft Sentinel (KQL).
• Experience with Cribl data pipelines (Stream / Edge).
• Knowledge of EDR, IAM and DLP log sources.
• Scripting (Python / PowerShell) is a plus.

Qualifications

• Bachelor’s degree in Computer Science, IT or Information Security.
• Splunk Core Certified Power User or Splunk Enterprise Certified Admin; Cribl Certified Admin – Stream or Cribl Certified Admin – Edge; and Microsoft Certified: Security Operations Analyst Associate (SC-200) for Microsoft Sentinel certifications will be a plus