Senior Security Engineer

HireFlex; India; On-site; INR 2,400,000 - 4,000,000; Full time

Job summary

HireFlex is seeking a Senior Security Engineer to own the technical qualification, design, onboarding, validation, and optimization of security telemetry, cloud integrations, and SIEM use cases. You will work with multiple teams to ensure secure, scalable, and cost-efficient integrations, while mentoring junior engineers.

You will lead SIEM onboarding requests, assess architectures, define DCRs, and develop KQL queries and detections to strengthen threat monitoring and security operations.

Qualifications

• 8+ years in security engineering, SIEM, or cloud security.
• Strong Azure security expertise: Entra ID, Monitor, Log Analytics, Key Vault, RBAC.
• Proficient in KQL and detection engineering for SIEM.
• Hands-on log ingestion, parsing, normalization, and schema design.
• Experience with telemetry pipelines and DCRs; on-call troubleshooting.
• Familiar with Azure Monitor Agent, Syslog, Logstash, Fluent Bit, Beats.
• Ability to mentor juniors and guide secure integration patterns.
• Familiarity with Splunk, QRadar, Elastic Security or similar SIEMs is a plus.

Responsibilities

• Lead SIEM onboarding, integrations, and security telemetry qualifications.
• Assess architecture, authentication, connectivity, and access requirements.
• Design and review telemetry pipelines and SIEM integration architectures.
• Define Data Collection Rules, parsers, transformations, and mappings.
• Develop KQL queries, analytics rules, detections, and hunting queries.
• Validate integrations through functional, security, and performance testing.
• Mentor engineers and produce technical documentation and runbooks.

Skills

Security engineering

Azure security

KQL

SIEM experience

Telemetry pipelines

Data collection rules

Security architecture

Git CI/CD

Tools

Azure Monitor

Log Analytics

Key Vault

RBAC

AML/AMA equivalents

Splunk

QRadar

Elastic Security

Terraform

Azure DevOps

GitHub Actions

Job description

Role Overview We are seeking a Senior Security Engineer to support the Engineering Qualification operating model, with responsibility for the technical assessment, design, onboarding, validation, and optimization of security telemetry, cloud integrations, and SIEM use cases. The role will work closely with Security Engineering, Threat Monitoring, Technology & Infrastructure teams, platform owners, and other stakeholders to ensure integrations are secure, scalable, supportable, and cost-effective. The engineer will also provide technical leadership and mentor junior team members.

Key Responsibilities

• Lead technical qualification of new SIEM onboarding requests, integrations, and security telemetry requirements.
• Assess solution architecture, security controls, authentication methods, connectivity, network dependencies, and access requirements.
• Design and review log onboarding patterns, telemetry pipelines, and SIEM integration architectures.
• Define and implement Data Collection Rules (DCRs), parsers, transformations, normalization, and schema mappings.
• Support adoption of Advanced Security Information Model (ASIM) normalization standards where applicable.
• Estimate telemetry volumes and assess ingestion, storage, retention, and operational cost implications.
• Design scalable and reusable ingestion patterns across cloud, on-premises, Linux, container, and third-party platforms.
• Develop and review KQL queries, analytics rules, detections, hunting queries, and SIEM use cases.
• Troubleshoot complex issues related to collection, ingestion, parsing, connectivity, authentication, and data quality.
• Validate integrations through functional, security, performance, and operational testing.
• Develop reusable engineering standards, onboarding templates, reference architectures, automation, and technical accelerators.
• Collaborate with Security Engineering, Threat Monitoring, T&I; teams, application teams, and platform owners.
• Review technical designs for alignment with security, architecture, and operational standards.
• Drive continuous improvement of telemetry quality, coverage, performance, and cost efficiency.
• Mentor junior engineers and provide technical oversight during onboarding and troubleshooting activities.
• Maintain high-quality engineering documentation, technical decision records, runbooks, and implementation standards.

Required Experience & Skills

• 8+ years of experience in Security Engineering, Security Operations Engineering, SIEM Engineering, Cloud Security, or a related discipline.
• Advanced Microsoft Azure experience, including Entra ID, Azure Networking, Log Analytics, Azure Monitor, Key Vault, and RBAC.
• Advanced experience with Microsoft Sentinel preferred; strong experience with another enterprise SIEM may be considered.
• Advanced knowledge of Kusto Query Language (KQL) and detection engineering.
• Strong hands-on knowledge of log ingestion, parsing, normalization, enrichment, and schema design.
• Experience with Azure Monitor Agent (AMA), Syslog, Logstash, Fluent Bit, Beats, or equivalent collection technologies.
• Experience designing and maintaining Data Collection Rules (DCRs) and telemetry pipelines.
• Strong understanding of security architecture, identity, authentication, network security, and secure integration patterns.
• Experience with telemetry volume estimation, retention planning, and SIEM cost optimization.
• Good working knowledge of Linux and container platforms.
• Experience with Git-based workflows and CI/CD practices.
• Demonstrated ability to troubleshoot complex integration and telemetry issues.
• Experience mentoring or technically guiding junior engineers.

Desirable Experience

• Experience with Splunk, IBM QRadar, Elastic Security, or other enterprise SIEM platforms.
• Experience with infrastructure-as-code and automation technologies such as Terraform, Bicep, Azure DevOps, or GitHub Actions.
• Experience developing detections mapped to MITRE ATT&CK; or equivalent frameworks.
• Knowledge of cloud-native security monitoring and multi-cloud telemetry architectures.
• Relevant Microsoft, Azure, SIEM, or cybersecurity certifications.