Senior Staff Engineer SOC Platform

Rakuten Symphony; Bengaluru; On-site; INR 3,500,000 - 7,000,000; Full time

Job summary

Rakuten Symphony in Bengaluru, India seeks a hands-on Senior SOC Engineer to build and scale our detection and response platforms. You will own the telemetry lifecycle from log ingestion to SIEM/SOAR management, bridging security and platform engineering to ensure data availability at scale.

You will architect and operate data lakehouse SIEM with Anvilogic, Snowflake, and Elastic, manage Cribl pipelines, and drive automation with Terraform and Ansible across on-prem and GCP.

Qualifications

• 10+ years in security/SOC engineering.
• Hands-on production experience with Anvilogic, Snowflake, and ClickHouse.
• Expertise with Cribl Stream/Edge and log pipelines.
• Strong Linux administration and scripting (Python/Bash).

Responsibilities

• Architect and manage clustered, multi-site deployments of modern data lakehouse SIEM architectures.
• Operate Cribl Stream/Edge to parse, filter, mask, and enrich data streams.
• Onboard diverse telecom, network, cloud, and enterprise sources; map detections to MITRE ATT&CK.
• Manage full stack across on-premises and GCP using Terraform and Ansible.
• Develop health checks, automation tooling, and disaster recovery plans.
• Deploy and manage containerized apps with Kubernetes; enable CI/CD pipelines.

Skills

Security SOC engineering

Log management

Cloud & on-prem infrastructure

Linux administration

Scripting Python/Bash

Tools

Anvilogic

Snowflake

ClickHouse

Cribl

Terraform

Ansible

Kubernetes

Docker

GCP

Elastic

Job description

Experience Level: 10+ years

Role Summary

We are seeking a hands‑on Senior SOC Engineer to build, operate, and scale the platforms powering our detection and response capabilities. This is an engineering-focused role—not an analyst or shift‑monitoring role. You will own the end‑to‑end telemetry lifecycle, from log ingestion and pipeline routing to SIEM/SOAR infrastructure management. You will bridge the gap between network operations, security analysts, and platform engineering to ensure high‑fidelity data availability at scale.

Key Responsibilities

• SIEM & SOAR Engineering: Architect and manage clustered, multi‑site deployments of modern data lakehouse SIEM architectures utilizing Anvilogic as the detection layer alongside Snowflake and Elastic data platforms. Own the lifecycle, performance tuning, and automation playbook development to drive down MTTR.
• Telemetry Pipeline (Cribl): Operate Cribl Stream/Edge to parse, filter, mask, and enrich data streams. Implement intelligent routing to optimize ingest costs and enable data replay for investigations.
• Log Collection & Onboarding: Architect high‑volume syslog tiers (rsyslog/syslog‑ng). Own the end‑to‑end onboarding of diverse telecom, network, cloud, and enterprise sources, ensuring alignment with standardized security models (OCSF/ECS) and mapping detections within Anvilogic to the MITRE ATT&CK framework.
• Platform & Infrastructure Ops: Manage the full stack across on‑premises and GCP environments. Use IaC (Terraform) and configuration management (Ansible) to automate platform health, capacity planning, and disaster recovery for your structured Snowflake warehouses and ClickHouse clusters.
• Systems Engineering: Administer enterprise Linux (RHEL/Ubuntu) at scale. Develop custom operational tooling and health‑check scripts using Python and Bash. Install, configure, and maintain Linux servers and operating systems across on‑premises and cloud environments. Monitor system performance, disk space, memory usage, and network connectivity; troubleshoot and resolve issues. Perform regular backups, disaster recovery planning, and ensure business continuity.
• Kubernetes: Deploy and manage containerized applications using Docker and Kubernetes, ensuring high availability and fault tolerance. Implement CI/CD pipelines with Kubernetes integration for automated testing, building, and deployment workflows. Configure service discovery, load balancing, ingress controllers, and persistent storage solutions.

Required Qualifications

• Experience: 10+ years in security/SOC engineering, log management, or infrastructure engineering.
• SIEM/SOAR Expertise: Hands‑on production experience administering Anvilogic, Snowflake, and ClickHouse security lakehouse architectures (clustering, data tiering, database optimization) and SOAR platforms (playbook development/connectors).
• Pipeline Proficiency: Expert‑level experience with log pipeline tooling (Cribl Stream/Edge preferred; Logstash/Vector/Kafka considered).
• Infrastructure Skills: Strong Linux administration, scripting (Python/Bash), and syslog fundamentals (TLS, load balancing, high‑volume tuning).
• Data Onboarding: Proven ability to write complex regex‑based parsers, field extractions, and normalization logic.
• Cloud & Networking: Working knowledge of GCP services (Logging, IAM, GKE, Networking) and solid grasp of networking fundamentals (TCP/UDP, DNS, routing, packet capture).
• Communication: Excellent written communication and disciplined documentation habits.

Preferred Qualifications

• Domain Expertise: Experience in a telecom or service provider environment (Mobile Core, 5G, IMS/VoLTE, SS7/Diameter, OSS/BSS).
• DevOps/Automation: Experience with Kubernetes/Helm, Terraform, and Ansible in hybrid environments.
• Detection Engineering: Exposure to Snowflake SQL, ClickHouse SQL, Anvilogic low‑code/no‑code builders, KQL, Sigma rules, and data lake/object storage tiering architectures.
• Certifications: Splunk Architect, Elastic Certified Engineer, Cribl Certified Admin, RHCE/RHCSA, Google Professional Cloud Security Engineer, AWS Professional certificate.