Principal Information Security Engineer

Overview

Senior technical role responsible for supporting, maturing and expanding the Security Operations Center (SOC) logging and monitoring functions, with a focus on Splunk, Cribl, SIEM detection engineering and data management.

What you'll do

• Design, implement and maintain the Splunk infrastructure, including upgrading Splunk and Cribl.
• Onboard data to Cribl using REST API, S3 collectors, HEC and similar methods.
• Implement and support multi-cloud infrastructure deployments using knowledge of cloud environments.
• Utilize data management platforms and other tools to enable efficient routing, parsing and filtering of data.
• Apply data engineering concepts such as data warehousing, real-time data processing and data normalization to enhance the data infrastructure.
• Leverage SIEM and data management platforms to collect, analyze and correlate logs.
• Lead the SIEM detection engineering function to develop and fine-tune correlation rules, alerts and dashboards to detect and respond to threats.
• Contribute to expanding data engineering practices, leveraging advanced analytics and machine learning for proactive threat detection.
• Participate in the purple team life cycle, collaborating with offensive and defensive security teams to improve detection and response strategies.
• Identify and implement automation opportunities to support operational excellence with SIEM and data management tooling.
• Collaborate with cross-functional teams to identify and mitigate security risks and vulnerabilities.
• Perform regular audits of security configurations, policies and procedures to ensure compliance with industry standards and regulations.
• Stay current on security trends, tools and best practices to continually enhance SIEM capabilities.
• Provide guidance and support to security engineers.

What you'll need

• Extensive experience with SIEM and data management platforms, particularly Splunk and Cribl, including deployment, configuration, optimization, administration and functional use (e.g., integration of log sources into SIEM, searching cloud archives with Cribl).
• Work toward CIM compliance for onboarded data sources by mapping fields to appropriate CIM fields and data models and addressing normalization gaps.
• Strong understanding of network protocols, firewalls, intrusion detection systems, endpoint security solutions and major cloud environments such as Azure, AWS and GCP.
• Demonstrated ability to deploy, configure and secure infrastructure in Azure, AWS and GCP.
• Proficiency in scripting languages (e.g., Python, PowerShell, Bash) for automation and task simplification.
• Strong understanding of security frameworks such as MITRE ATT&CK.
• Hands-on experience developing, tuning and deploying security detections in SIEM.
• Excellent analytical skills to identify, analyze and resolve complex engineering issues.
• Knowledge of security frameworks and standards (e.g., COBIT, NIST 800-53, ISO 27001, SSAE16, SOC1, SOC2, etc.).
• Proficiency in Microsoft Word, Excel, PowerPoint and Visio, with the ability to create clear technical documentation and presentations.
• Strong verbal and written communication skills and strong presentation skills.
• Ability to manage multiple high-priority projects and tasks effectively, aligned with strategic security goals.
• Ability to work collaboratively in a team-oriented environment, leading by example and fostering collaboration and continuous improvement.
• Generally requires a bachelor's degree in computer science, Information Technology, Cybersecurity or a related field, or equivalent work experience.
• A minimum of 10 years' information security experience, with a strong focus on SIEM, data management and security operations.
• Relevant certifications such as Splunk Certified Power User/Admin, Cribl Certified Admin, Security+, CEH, OSCP, CISSP, etc.

Nice to have

• Experience using Cursor, ChatGPT or similar AI platforms to support engineering work.
• Familiarity with Azure DevOps, including work tracking or delivery workflows.
• Experience with scripting or automation using Python, Bash or PowerShell.
• Splunk or Cribl certifications or relevant training.
• Familiarity with APIs, syslog, forwarders, cloud integrations and common security or observability data sources.
• Experience with IT service management, change management and vulnerability remediation workflows.
• Familiarity with cloud platforms, containers or infrastructure-as-code.

Details

• Location: Karnataka, Bangalore, India.
• May be required to perform duties outside normal work hours based on business needs, including operational on-call support and other ad-hoc requirements.