SIEM Content Development Specialist - VOIS

VOIS; Pune District; Sur place; INR 2 500 000 - 4 200 000; Plein temps

Résumé du poste

VOIS in Pune/Bangalore is seeking a SIEM Content Development Specialist to translate business requirements and threat intelligence into robust detections across SIEM, EDR, and XDR. You will develop and tune detection content, map to MITRE ATT&CK, collaborate with log-source owners, and contribute to playbooks, using Elastic/ELK, ArcSight, and other tools.

This role demands 6+ years in security operations, strong SDLC/Agile experience, and hands-on coding in Python, SQL, JavaScript, PowerShell,

Qualifications

• 6+ years in Security Operations or related fields.
• Experience with SDLC and Agile methodologies.
• Strong knowledge of Elastic Security/ELK stack.
• Experience with ArcSight and Elastic/ELK detections.
• Understanding MITRE ATT&CK and cyber kill chain concepts.

Responsabilités

• Develop and enhance SIEM/EDR/XDR detection content.
• Create threat scenarios and rules for Elastic/ELK and ArcSight.
• Tune detection rules to improve CSOC efficiency and accuracy.
• Analyse adversaries and techniques to build detections.
• Map detections to MITRE ATT&CK and kill chain concepts.
• Collaborate with log-source owners to translate telemetry into use cases.
• Contribute to threat-response playbooks and workflows.
• Apply SDLC and Agile practices to detection projects.
• Develop detection content using Python, SQL, JavaScript, PowerShell, KQL, ES/QL.
• Create and maintain Regex patterns for analytics.
• Produce cyber security reports and post-incident learnings.

Connaissances

SIEM content development

Security operations

Threat hunting

Threat intelligence

Python

SQL

JavaScript

PowerShell

KQL

Regex

Formation

Bachelor's degree in IT/Engineering

Outils

Elastic/ELK

ArcSight

Splunk

Microsoft Sentinel

Chronicle

Log Analytics

AWS

Azure

GCP

Description du poste

Who We Are

VOIS (Vodafone Intelligent Solutions) is a strategic arm of Vodafone Group Plc, creating value for customers by delivering intelligent solutions through Talent, Technology & Transformation.

About This Role

We are seeking a SIEM Content Development Specialist to contribute to the Cyber Security Operations Centre (CSOC) detection capability within Cyber Defence. Based in Pune or Bangalore, India, this individual contributor role focuses on translating business requirements, threat intelligence, the evolving threat landscape, MITRE TTPs and cyber risks into effective detection content.

You will develop, tune and improve SIEM, EDR and XDR detection capabilities, with particular emphasis on Elastic Security/ELK, KQL, ES|QL and Regex. The role requires at least 6 years of relevant experience across areas such as Security Operations, SIEM content development, security engineering, threat hunting or threat intelligence.

You will operate with limited supervision, make informed technical decisions and collaborate with stakeholders across the security community.

What You’ll Do

• Develop and enhance detection content across existing and new SIEM, EDR and XDR technologies.
• Create threat scenarios and SIEM detection rules/use cases, particularly within Elastic Security/ELK and ArcSight environments.
• Tune detection rules and correlation logic to improve CSOC efficiency, detection quality and risk reduction.
• Analyse adversaries, attack techniques and tools to create indicator-based and behavioural detections.
• Map security detections to MITRE ATT&CK TTPs, cyber kill chain concepts and relevant APT campaign strategies.
• Collaborate with log-source owners and customers to understand telemetry, security requirements and use cases, translating them into actionable detection content.
• Contribute to and potentially lead threat-response workflows and playbook development and integration.
• Apply software engineering, SDLC and Agile practices to security content engineering initiatives.
• Develop security content using technologies and languages including Python, SQL, JavaScript, PowerShell, KQL and ES|QL, as appropriate.
• Develop and maintain Regex patterns supporting security analytics and detection.
• Analyse security events and identify potential threats that could evade existing custom or out-of-the-box detections.
• Contribute to cyber security reports and advisories for relevant stakeholders.
• Perform post-incident analysis and translate lessons learnt and residual risks into actionable improvements.
• Create and maintain documentation, including detection-development workflows and playbooks.
• Continuously improve the SOC use-case framework and the effectiveness of detection and response capabilities.
• Prioritise concurrent activities and deliver work within agreed deadlines.
• Contribute technical leadership to security content projects where required.

Who You Are

• 6+ years of experience in Security Operations (SOC), SIEM content development, security engineering, threat hunting and/or threat intelligence.
• Practical experience with SDLC frameworks and Agile methodologies.
• Strong working knowledge of Elastic Security/ELK, including Elastic, Logstash and Kibana.
• Understanding of other SIEM platforms such as ArcSight, Microsoft Sentinel, Splunk, Chronicle and cloud-native SIEM technologies.
• Experience developing threat scenarios and SIEM detection rules/use cases, preferably using ArcSight and Elastic/ELK.
• Knowledge of cloud and security telemetry across AWS, GCP and Microsoft technologies, including EDR, Log Analytics and Azure, as well as Oracle environments.
• Software engineering or development experience and an understanding of data structures and algorithms.
• Expertise in one or more relevant languages or technologies, such as Python, SQL, JavaScript, PowerShell, KQL or ES|QL.
• Strong practical knowledge of regular expressions (Regex).
• In-depth knowledge of MITRE ATT&CK, cyber kill chain concepts, APT campaigns, security threats and vulnerabilities.
• Hands-on experience analysing security events, refining SIEM content and improving detection efficiency.
• Knowledge of cyber-risk analysis, management and security-reporting frameworks.
• Deep understanding of networking concepts, including TCP/IP, CIDR, subnetting, addressing and network communications.
• Knowledge of security technologies including firewalls, intrusion-detection systems, antivirus systems, anti-spam technologies, event-correlation platforms and log-analysis tools.
• Understanding of security-tool architecture and design, including technologies used to identify advanced threats.
• Strong analytical, stakeholder communication, prioritisation and time-management skills.
• A degree in Information Technology, Engineering or a similar discipline.
• Prior or current information security or advanced networking certifications, including qualifications such as CISSP, GCIH or GCIA.

What's In It For You

• Work on cyber defence and detection capabilities that protect Vodafone customers against global cyber risk.
• Gain exposure to enterprise-scale SIEM, EDR and XDR technologies in a Cyber Security Operations Centre environment.
• Work across multiple detection technologies, cloud environments, telemetry sources and security use cases.
• Collaborate with log-source owners, customers and security stakeholders across the Vodafone security community.
• Contribute to projects spanning detection engineering, threat response, threat hunting, cyber-risk reduction and security automation.
• Take ownership of technical decisions and contribute to the direction of security content engineering projects.

What Skills You Will Learn

• Advanced SIEM detection and security content engineering.
• Elastic Security/ELK, KQL, ES|QL and Regex.
• EDR/XDR detection development and operational tuning.
• MITRE ATT&CK-aligned detection engineering and threat modelling.
• Behavioural and indicator-based detection methodologies.
• Threat hunting and analysis of adversary techniques and attack tools.
• Security use-case design across cloud and enterprise telemetry.
• Threat-response playbook and workflow development.
• Applying SDLC and Agile methodologies to detection engineering.
• Post-incident learning and converting identified risks into detection improvements.

VOIS Equal Opportunity Employer Commitment

Vodafone recognises and celebrates the value of diversity in building a workforce that reflects the customers and communities it serves. No form of discrimination is tolerated. This includes, but is not limited to, discrimination based on race, colour, age, veteran status, gender identity, gender expression, sexual orientation, pregnancy, maternity or parental status, ethnicity, disability, religion or belief, political affiliation, trade union membership, nationality, citizenship, indigenous status, medical condition, HIV status, neurodiversity, social origin, cultural background, marital or civil partnership status, or socio-economic background.

Join Us

At Vodafone, we’re working hard to build a better future. A more connected, inclusive and sustainable world. As a dynamic global community, it's our human spirit, together with technology, that empowers us to achieve this.

We challenge and innovate in order to connect people, businesses, and communities across the world. Delighting our customers and earning their loyalty drive us, and we experiment, learn fast and get it done, together.

With us, you can truly be yourself and belong, share inspiration, embrace new opportunities, thrive, and make a real difference.

Follow us on social media and #StayConnected

LinkedIn: https://www.linkedin.com/company/vois/

Facebook: https://www.facebook.com/voisglobal

Instagram: https://www.instagram.com/voisglobal/