Siem Engineer

Tata Consultancy Services; Ernakulam; On-site; INR 1,500,000 - 3,000,000; Full time

Job summary

Tata Consultancy Services is seeking an experienced Enterprise SIEM Architect to lead the design, deployment and operation of large-scale SIEM solutions across cloud and on-prem environments. You will work with QRadar, Splunk, ArcSight, and Sentinel, implement advanced correlation, parsing, and logging standards, and drive incident response and SOC activities.

This role requires strong knowledge of MITRE ATT&CK, regex-based parsers, and integration of cloud logs from GCP/AWS/Azure with 3rd party

Qualifications

• Enterprise SIEM architect exposure with extensive deployment experience.
• Hands-on knowledge of SIEM products: QRadar, Sentinel, Splunk, ArcSight.
• Expertise in SIEM concepts: correlation, aggregation, normalization, parsing.
• Experience with incident response and SOC operations.
• Experience deploying and managing large SIEM deployments.
• Strong understanding of enterprise logging standards, focusing on applications.
• 6+ years of experience with Sentinel SIEM.
• Knowledge of MITRE ATT&CK framework and TTPs.
• Regex proficiency and custom/flex parsers development.
• Logging across GCP, AWS, Azure and integration with 3rd party tools.
• Experience with syslog-ng in complex multi client-server infra.
• 5+ years in network and system security.

Skills

SIEM architecture

SIEM products

Correlation

Normalization

Parsing

Incident response

SOC operations

Large deployments

Enterprise logging

MITRE ATT&CK

Regex

Cloud logs integration

Cloud platforms

syslog-ng

Network security

Sentinel SIEM

Third-party integrations

Tools

QRadar

Splunk

ArcSight

Sentinel

Elastic Cloud

syslog-ng

Job description

Role & responsibilities

• Enterprise SIEM Architect exposure. Multiple SIEM deployement experience. SOC Domain Specialized.
• Excellent knowledge of one of the SIEM products, Qradar Sentinel, Splunk, ArcSight, etc.
• Excellent understanding and proven hands-on experience in SIEM concepts such as correlation, aggregation, normalization, and parsing
• Experience with Incident response and Security Operations Center operations
• Experience with deploying and managing a large SIEM deployment
• Excellent understanding of enterprise logging standards, with a focus on application logging
• 6 years of experience with Sentinel SIEM systems
• Excellent knowledge of adversary tactics, techniques and procedures (TTPs) and MITRE ATT&ACK Framework
• Excellent understanding of regular expressions, development of custom/flex Parsers
• Excellent understanding of log flow from numerous services within GCP, AWS, Azure cloud and experience with integrating them with 3rd party logging tools including but not limited to Sentinel and Elastic Cloud
• Good Experience with syslog-ng i.e., configuring complex multi client-server infrastructures.
• 5+ years of network security and system security experience, supporting security event management tools (SIEMs)