SOC/SIEM L3 LogRhythm _ Bangalore (WFO)

Tata Communications Limited; Bengaluru; On-site; INR 2,500,000 - 4,000,000; Full time

Job summary

Tata Communications Limited in Bengaluru (Bangalore) is seeking a Manager L3 for its SIEM practice. This role focuses on advanced incident support, root cause analysis, and guiding L2 colleagues through complex investigations.

You will oversee SIEM agent management, log source integration across on-prem and cloud, develop detection use cases per MITRE ATT&CK, and drive automation with SOAR. Strong leadership and collaboration with infra, cloud, and app teams are essential.

Qualifications

• Experience: 8-12 years in SIEM/ security operations.
• Strong incident response, forensics, and threat analysis skills.
• Experience with SIEM agent management, log parsing, and data normalization.

Responsibilities

• Lead advanced incident support and root-cause analysis.
• Manage SIEM agents across upgrades and patches.
• Design and onboard new log sources across on-prem and cloud.
• Develop detection use cases aligned with MITRE ATT&CK.
• Integrate automation and SOAR with security tools.
• Provide technical leadership and mentoring to L2 teams.
• Prepare and present regular customer reports.

Job description

Role: Manager L3

Location: Bangalore

Work Mode: WFO

JD:

L3 SIEM Roles & Responsibilities

Experience (8-12 Years)

1. Advanced Incident Support & Root Cause Analysis
2. Support L2 in handling complex and critical security incidents
   1. Perform deep forensic analysis and root cause identification
   2. Investigate sophisticated threats (APT, zero-day behavior, stealth attacks)
   3. Provide final technical validation and resolution guidance
3. SIEM Agent Management
4. Manage upgrades, patches, and hotfix deployments for System monitor agents
5. Ensure Log Source MPS volume analysis
6. Log Source Integration & Parsing
   1. Design and onboard new log sources across on-prem and cloud environments
   2. Develop and maintain parsing logic, normalization, and field mappings
   3. Resolve complex ingestion issues (protocol, TLS, format mismatches)
   4. Ensure data quality and consistency across all sources
7. Detection & Use Case Development
   1. Design and implement advanced correlation rules and detection logic
   2. Build new use cases aligned with frameworks like MITRE ATT&CK
   3. Integrate threat intelligence feeds and automation into detection workflows
   4. Continuously enhance detection coverage and reduce blind spots
8. Automation & SOAR Integration Add/Maintain automation workflows and response playbooks

• Integrate SIEM with SOAR and other security tools (EDR, IAM, Firewall)
• Optimize response time through orchestration and automation

1. Performance Optimization & Troubleshooting Diagnosing and resolving log source- issues
   1. Optimize pipelines, indexing, and query performance
2. Governance, Compliance & Best Practices Define SIEM standards, architecture guidelines, and best practices
   1. Ensure compliance with regulatory and audit requirements and support customers on Audits
   2. Maintain documentation for configurations, integrations, and fixes
3. Collaboration & Technical Leadership
4. Act as the escalation point for L2 and guide them on complex investigations
5. Provide technical leadership, mentoring, and knowledge sharing Collaborate with infrastructure, cloud, and application teams
6. Continuous Improvement & Innovation
7. Identify gaps in detection, logging, and response capabilities of log sources
8. Driving use case enhancements and modernization initiatives
9. Evaluate and implement new security technologies and integrations and validate overall security maturity assessment.
10. Reports

Based on customers, Drive Daily/ Weekly/ Monthly/ Quarterly reports

Provide visibility and drive calls with customers