SIEM Content Development Specialist - VOIS

Vodafone Group Plc; Pune District; On-site; INR 3,500,000 - 6,000,000; Full time

Job summary

VOIS (Vodafone Intelligent Solutions) in India is seeking a SIEM Content Development Specialist to translate threat intelligence and MITRE frameworks into effective detection content. Based in Pune or Bangalore, you will develop, tune and improve SIEM/EDR/XDR detections using Elastic Security/ELK, KQL and Regex, collaborating with security stakeholders.

You will lead detection engineering efforts, map detections to MITRE ATT&CK, and contribute to playbooks and post-incident reviews, while

Qualifications

• 6+ years in Security Operations, SIEM content development or threat intelligence.
• Experience with SDLC and Agile methodologies in security projects.
• Strong knowledge of Elastic Security/ELK and ArcSight platforms.

Responsibilities

• Develop and enhance SIEM/EDR/XDR detection content across technologies.
• Map detections to MITRE ATT&CK and cyber kill chain concepts.
• Collaborate with log-source owners and stakeholders to translate telemetry into detections.
• Lead threat-response playbooks and post-incident reviews.
• Apply SDLC/Agile practices to detection engineering initiatives.

Skills

SIEM content development

Security Operations

Threat hunting

Threat intelligence

Education

Information Technology / Engineering degree

Tools

Elastic/ELK

ArcSight

Python

KQL

Regex

Job description

Who we are

VOIS (Vodafone Intelligent Solutions) is a strategic arm of Vodafone Group Plc, creating value for customers by delivering intelligent solutions through Talent, Technology & Transformation. As the largest shared services organisation in the global telco industry with 30,000 FTE, our portfolio of next-generation solutions and services are designed in partnership with customers across Vodafone Group, local markets, and partner markets to simplify and drive growth. With our strategic partner Accenture, we work alongside our Vodafone customers, other Telco and tech companies to drive transformation, meet the challenges of our industry and ensure we stay relevant and resilient. This partnership is a unique, industry-first model which brings together the best of in-house and 3rd party capability. We work with customers across 28 countries from 10 VOIS locations: Albania, Egypt, Hungary, India, Romania, Spain, Turkey, UK, Germany, Ireland, and with a network of teams in Czech Republic, Italy, Greece, and Portugal.

About this Role

We are seeking a SIEM Content Development Specialist to contribute to the Cyber Security Operations Centre (CSOC) detection capability within Cyber Defence. Based in Pune or Bangalore, India, this individual contributor role focuses on translating business requirements, threat intelligence, the evolving threat landscape, MITRE TTPs and cyber risks into effective detection content. You will develop, tune and improve SIEM, EDR and XDR detection capabilities, with particular emphasis on Elastic Security/ELK, KQL, ES|QL and Regex. The role requires at least 6 years of relevant experience across areas such as Security Operations, SIEM content development, security engineering, threat hunting or threat intelligence. You will operate with limited supervision, make informed technical decisions and collaborate with stakeholders across the security community.

What you'll do

• Develop and enhance detection content across existing and new SIEM, EDR and XDR technologies.
• Create threat scenarios and SIEM detection rules/use cases, particularly within Elastic Security/ELK and ArcSight environments.
• Tune detection rules and correlation logic to improve CSOC efficiency, detection quality and risk reduction.
• Analyse adversaries, attack techniques and tools to create indicator-based and behavioural detections.
• Map security detections to MITRE ATT&CK TTPs, cyber kill chain concepts and relevant APT campaign strategies.
• Collaborate with log-source owners and customers to understand telemetry, security requirements and use cases, translating them into actionable detection content.
• Contribute to and potentially lead threat-response workflows and playbook development and integration.
• Apply software engineering, SDLC and Agile practices to security content engineering initiatives.
• Develop security content using technologies and languages including Python, SQL, JavaScript, PowerShell, KQL and ES|QL, as appropriate.
• Develop and maintain Regex patterns supporting security analytics and detection.
• Analyse security events and identify potential threats that could evade existing custom or out-of-the-box detections.
• Contribute to cyber security reports and advisories for relevant stakeholders.
• Perform post-incident analysis and translate lessons learnt and residual risks into actionable improvements.
• Create and maintain documentation, including detection-development workflows and playbooks.
• Continuously improve the SOC use-case framework and the effectiveness of detection and response capabilities.
• Prioritise concurrent activities and deliver work within agreed deadlines.
• Contribute technical leadership to security content projects where required.

Who you are

• 6+ years of experience in Security Operations (SOC), SIEM content development, security engineering, threat hunting and/or threat intelligence.
• Practical experience with SDLC frameworks and Agile methodologies.
• Strong working knowledge of Elastic Security/ELK, including Elastic, Logstash and Kibana.
• Understanding of other SIEM platforms such as ArcSight, Microsoft Sentinel, Splunk, Chronicle and cloud-native SIEM technologies.
• Experience developing threat scenarios and SIEM detection rules/use cases, preferably using ArcSight and Elastic/ELK.
• Knowledge of cloud and security telemetry across AWS, GCP and Microsoft technologies, including EDR, Log Analytics and Azure, as well as Oracle environments.
• Software engineering or development experience and an understanding of data structures and algorithms.
• Expertise in one or more relevant languages or technologies, such as Python, SQL, JavaScript, PowerShell, KQL or ES|QL.
• Strong practical knowledge of regular expressions (Regex).
• In-depth knowledge of MITRE ATT&CK, cyber kill chain concepts, APT campaigns, security threats and vulnerabilities.
• Hands‑on experience analysing security events, refining SIEM content and improving detection efficiency.
• Knowledge of cyber-risk analysis, management and security-reporting frameworks.
• Deep understanding of networking concepts, including TCP/IP, CIDR, subnetting, addressing and network communications.
• Knowledge of security technologies including firewalls, intrusion‑detection systems, antivirus systems, anti‑spam technologies, event‑correlation platforms and log‑analysis tools.
• Understanding of security‑tool architecture and design, including technologies used to identify advanced threats.
• Strong analytical, stakeholder communication, prioritisation and time‑management skills.
• A degree in Information Technology, Engineering or a similar discipline.
• Prior or current information security or advanced networking certifications, including qualifications such as CISSP, GCIH or GCIA.

Not a perfect fit?

Concerned you may not meet every requirement? Vodafone is committed to creating an inclusive workplace where everyone can thrive. If you are excited about this role but your experience does not align exactly with every aspect of the job description, you are encouraged to apply. You may be the right candidate for this or another opportunity, and the recruitment team will support you in exploring where your skills fit best.

What's in it for you

• Work on cyber defence and detection capabilities that protect Vodafone customers against global cyber risk.
• Gain exposure to enterprise-scale SIEM, EDR and XDR technologies in a Cyber Security Operations Centre environment.
• Work across multiple detection technologies, cloud environments, telemetry sources and security use cases.
• Collaborate with log‑source owners, customers and security stakeholders across the Vodafone security community.
• Contribute to projects spanning detection engineering, threat response, threat hunting, cyber‑risk reduction and security automation.
• Take ownership of technical decisions and contribute to the direction of security content engineering projects.

What skills you will learn

• Advanced SIEM detection and security content engineering.
• Elastic Security/ELK, KQL, ES|QL and Regex.
• EDR/XDR detection development and operational tuning.
• MITRE ATT&CK-aligned detection engineering and threat modelling.
• Behavioural and indicator-based detection methodologies.
• Threat hunting and analysis of adversary techniques and attack tools.
• Security use‑case design across cloud and enterprise telemetry.
• Threat‑response playbook and workflow development.
• Applying SDLC and Agile methodologies to detection engineering.
• Post‑incident learning and converting identified risks into detection improvements.

VOIS Equal Opportunity Employer Commitment

Vodafone recognises and celebrates the value of diversity in building a workforce that reflects the customers and communities it serves. No form of discrimination is tolerated. This includes, but is not limited to, discrimination based on race, colour, age, veteran status, gender identity, gender expression, sexual orientation, pregnancy, maternity or parental status, ethnicity, disability, religion or belief, political affiliation, trade union membership, nationality, citizenship, indigenous status, medical condition, HIV status, neurodiversity, social origin, cultural background, marital or civil partnership status, or socio-economic background.

Join Us

At Vodafone, we're working hard to build a better future. A more connected, inclusive and sustainable world. As a dynamic global community, it's our human spirit, together with technology, that empowers us to achieve this. We challenge and innovate in order to connect people, businesses, and communities across the world. Delighting our customers and earning their loyalty drive us, and we experiment, learn fast and get it done, together. With us, you can truly be yourself and belong, share inspiration, embrace new opportunities, thrive, and make a real difference.

Follow us on social media and #StayConnected

LinkedIn: https://www.linkedin.com/company/vois/

Facebook: https://www.facebook.com/voisglobal

Instagram: https://www.instagram.com/voisglobal/