Lead Engineer - SIEM & Detection Platforms

Overview

Lead enterprise detection engineering for SIEM and detection platforms, owning detection strategy, content and quality across cloud, on-premises and OT/ICS environments.

What you'll do

• Lead end-to-end detection engineering initiatives spanning threat coverage, detection algorithms and efficacy validation across SIEM, EDR, NDR and cloud-native services.
• Build, optimise and govern the detection content library, mapping coverage to MITRE ATT&CK tactics, techniques and procedures.
• Drive performance optimisation of detection mechanisms and platform queries, balancing sensitivity with operational efficiency to reduce alert fatigue.
• Provide technical oversight to external suppliers and platform vendors.
• Coordinate with SOC, incident response and cyber threat analysis teams to validate efficiency and close coverage gaps.
• Continuously assess the threat landscape, identify detection gaps and systematically develop new detections for emerging techniques.
• Introduce and scale new detection techniques, including behavioural analytics and machine learning approaches; champion detection-as-code, scripting and orchestration.
• Define detection engineering standards, development methodologies and quality controls for repeatable, portable and maintainable detection logic.
• Partner with offensive security to emulate adversaries and validate detections, converting lessons learned into stronger coverage.
• Establish measurable benchmarks for coverage, fidelity and time-to-detect, and lead tuning cycles that reduce false positives.

What you'll need

• Bachelor's degree in information security, computer science or a related field, or equivalent experience.
• At least five years of experience in detection engineering, preferably within security operations centres or detection engineering teams.
• Proven success leading detection initiatives and applying innovative approaches at enterprise scale.
• Deep expertise in detection logic design, threat modelling and coverage mapping across diverse platforms and environments.
• Comprehensive familiarity with MITRE ATT&CK, Cyber Kill Chain and detection engineering methodologies.
• At least five years of hands-on experience with enterprise detection platforms, including SIEM, EDR, NDR and cloud-native security services, with advanced proficiency in platform-specific query languages, rule formats and detection logic.
• Working knowledge of how threat intelligence is consumed and translated into actionable detection logic, including indicator types, threat actor TTPs and detection prioritisation.
• At least three years of experience using scripting languages such as Python, PowerShell or similar for detection logic development and automation, with experience of detection-as-code and version control.
• At least three years of experience with standardised detection formats, including Sigma rules, YARA signatures and platform-specific query languages.
• Deep understanding of detection tuning, false positive reduction and query optimisation.
• Familiarity with operational technology environments and the constraints affecting detection in industrial settings, including safety and availability implications.
• Experience working with offensive security teams to validate detection efficacy and identify coverage gaps.
• Working experience with threat intelligence, adversary TTPs and attack techniques across cloud, on-premises and OT environments.
• Experience working in a global organisation with geographically dispersed and matrix teams, coordinating across time zones and cultural contexts.
• Substantial experience collaborating with security operations teams, incident responders and threat intelligence analysts, and managing relationships with third-party suppliers and vendors.
• Recognised internally as an expert problem solver for complex detection challenges, with a track record of implementing innovative detection solutions.

Nice to have

• Relevant security certifications related to detection development, for example GIAC GCIA, GCDA or GMON, platform-specific certifications, or threat hunting certifications.
• Experience adopting new detection techniques, behavioural analytics and computational intelligence methods, and leading training and change management to ensure successful adoption.

Details

• Location: Chennai, India.
• Work mode: in-person working, on average a minimum of three days per week from the office, with individual flexibility.
• Date posted 16-Oct-2026; closing date 23-Oct-2026.