Staff Security Engineer – Detection & Response

Chegg, Inc.; New Delhi; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Chegg, Inc. in New Delhi invites a Staff Security Engineer (Detection & Response) to triage alerts from SIEM/UEBA, EDR, cloud and email security and lead incidents end to end.

You will own incident documentation, post-incident reviews, and drive durable fixes while expanding detection coverage. The role requires 7+ years in security operations, hands-on detection tuning, and strong communication skills to coordinate with IT, engineering, and cloud teams.

Qualifications

• 7+ years in security operations, detection or IR.
• Experience leading incident response end-to-end.
• Strong understanding of attacker tradecraft and MITRE ATT&CK.
• Hands-on with SIEM/UEBA, EDR, cloud and email security.
• Ability to write and tune detection logic and playbooks.

Responsibilities

• Triage and investigate alerts from SIEM/UEBA, EDR, cloud and email security.
• Lead security incidents end to end: containment, eradication, recovery.
• Document timelines, root cause analyses and post-incident reviews.
• Develop and maintain incident response playbooks and runbooks.
• Build and tune detection content to reduce false positives.
• Collaborate with IT/engineering/cloud teams to remediate weaknesses.

Skills

SIEM/UEBA

Incident response

Cloud security

Threat detection

Python scripting

Cross-team collaboration

Windows/Linux/macOS forensics

Education

Bachelor's or above in CS/Security

Tools

EDR (e.g., SentinelOne)

Cloud security tooling (AWS)

SOAR platforms

Job description

## Staff Security Engineer – Detection & ResponseApply: Jasola, New Delhi: Full time: Posted Today: End Date: December 31, 2026 (30+ days left to apply): R5409****Job Description******Staff Security Engineer Detection & Response**Your goal to improve the education process and better the lives of students by keeping their data secure.**What you will do:*** Triage and investigate alerts from our SIEM/UEBA, endpoint detection and response, cloud, and email security platforms to determine whether indicators of compromise represent a real intrusion* Declare, lead, and manage security incidents end to end endpoint compromise, cloud and infrastructure compromise, credential theft, phishing, and insider risk through containment, eradication, and recovery* Own written incident documentation, including timelines, root cause analysis, and post-incident reviews that drive durable fixes rather than one-off cleanup* Build, tune, and maintain detection content to expand coverage of real attacker behavior while reducing false positives and alert fatigue* Develop and maintain incident response playbooks and runbooks* Between incidents, contribute to security engineering work: deploying and operating security tooling in our cloud environment, closing logging and telemetry gaps, and automating response actions* Partner with IT, engineering, and cloud platform teams to drive remediation of identified weaknesses to closure**What you’ll bring*** 7+ years of relevant work experience, with significant time spent in security operations, detection and response, or incident response* Hands-on experience investigating alerts across SIEM/UEBA and endpoint detection and response tooling, and separating true positives from noise at volume* Demonstrated experience leading incident response from detection through recovery, including coordinating responders and stakeholders across teams* Strong understanding of attacker tradecraft and common attack paths across endpoint, identity, network, and cloud, and familiarity with a framework such as MITRE ATT&CK* Working knowledge of security in cloud environments, ideally AWS, including identity, logging, and the misconfigurations attackers most often abuse* Experience writing and tuning detection logic, correlation rules, or queries against large log data sets* Scripting and automation ability, such as Python, and comfort working with open-source tools and APIs to connect systems and remove manual effort* Practical familiarity with Windows, macOS, and Linux internals, and the forensic artifacts each produces during an investigation* Sound judgment and composure under pressure, including the ability to make decisions with incomplete information* Excellent written and oral communication skills, including the ability to explain an incident clearly to both engineers and executives* Ability to work independently and with various other teams across the organization* Creative, resourceful, and adaptive problem solving**Stand Out Qualifications*** Experience with a SIEM or UEBA platform such as Exabeam, and an endpoint detection and response platform such as SentinelOne* Experience working in AWS with features such as GuardDuty, CloudTrail, Security Hub, Inspector, IAM, WAF and Shield* Experience managing detection content as code, under version control and peer review* Familiarity with SOAR platforms and automated response workflows* Digital forensics, malware analysis, or reverse engineering experience* Experience working with container technologies including Docker and Kubernetes* Relevant certifications such as GCIH, GCIA, GCFA, OSCP, or AWS Certified Security – Specialty