Security Engineer III - IN

Overview

Security Engineer III (SIEM Engineer L3) within Rackspace Cyber Defence, responsible for onboarding, integrating and administering SIEM platforms, with primary focus on Microsoft Sentinel and Elastic Security.

What you'll do

• Assist with customer onboarding by configuring and integrating data feeds into SIEM platforms, with primary focus on Microsoft Sentinel and Elastic Security.
• Ensure the customer's operational and production environment remains healthy and secure at all times.
• Onboard and integrate on-premises and cloud resources into Elastic SIEM and MS Sentinel, ensuring reliable security log ingestion, parsing, and monitoring.
• Develop custom dashboards and reporting templates.
• Develop complex, customer-specific use cases.
• Advance platform administration, ideally through a DevOps-centric approach.
• Recommend solutions for issues and coordinate with vendors for issue resolution.
• Create and enhance basic and intermediate playbooks and workflows.
• Maintain close working relationships with relevant teams and key stakeholders, such as incident response, disaster recovery and information security teams.
• Develop custom parsers for incident and alert enrichment.
• Create and enhance problem-specific playbooks and workflows.

What you'll need

• 8+ years of relevant experience.
• Proven experience administering, configuring and supporting Microsoft Sentinel and Elastic Security (Elastic SIEM) in large-scale cloud and enterprise environments, with the ability to independently manage SIEM operations, onboarding, integrations and troubleshooting.
• Elastic SIEM / Elastic Security (mandatory): strong hands-on expertise in Elasticsearch, Kibana, Elastic Agent, Fleet, Logstash, data ingestion, integration management, parsing, ECS normalization, detection rules, alerts, dashboards and incident investigation.
• Experience integrating and monitoring security logs from Microsoft Azure, Microsoft 365, GCP and AWS environments within Elastic Security.
• Experience onboarding and analyzing security telemetry from Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Defender for Cloud and Microsoft Defender for Office 365.
• Experience integrating and monitoring endpoint security events from solutions such as CrowdStrike and Microsoft Defender for Endpoint.
• Experience onboarding and troubleshooting security logs from firewalls and network security platforms, including Palo Alto, Fortinet, Juniper and Cisco.
• Experience integrating and monitoring WAF logs from Cloudflare, Akamai and Azure WAF.
• Experience integrating and analyzing email security telemetry from Proofpoint, Mimecast and Microsoft Defender for Office 365.
• Experience integrating and monitoring DLP events from Microsoft Purview, McAfee and Symantec solutions.
• Experience onboarding and analyzing AWS security logs and findings from AWS Security Hub, GuardDuty, Macie, AWS Config and CloudTrail.
• Experience integrating GCP logs into SIEM tools.
• Ability to independently troubleshoot ingestion failures, parsing issues, integration errors, agent health, data gaps and performance problems, and to optimize data ingestion, retention and storage.
• Experience developing and maintaining detection rules, alerting workflows, dashboards and investigation queries to support SOC monitoring and incident response.
• Ability to take end-to-end ownership of the Elastic Security platform, from initial deployment and data source onboarding through ongoing administration, maintenance, optimization and operational support.
• Experience of security controls, such as network access controls; identity, authentication and access management controls (IAAM); and intrusion detection and prevention controls.
• Knowledge of scripting and coding with languages such as Terraform, Python, JavaScript, Golang, Bash and/or PowerShell.
• Knowledge of DevOps practices such as CI/CD, Azure DevOps, CircleCI, GitHub Actions, Ansible and/or Jenkins.
• Ability to prioritize multiple incidents in a fast-paced operational environment.
• Ability to work flexible schedules and support critical customer situations.

Nice to have

• Good to have experience in Splunk, IBM QRadar and Google SecOps (Chronicle).
• Knowledge of security standards such as NIST, ISO27001, CIS (Center for Internet Security), OWASP and Cloud Controls Matrix (CCM).
• Holds one or more of the following certifications (or equivalent): Microsoft Certified: Security Operations Analyst Associate (SC-200); Elastic Certified SIEM Analyst / Elastic Certified Engineer; CompTIA Security+ / CySA+; GIAC Security Operations Certified (GSOC); Certified Information Security Systems Professional (CISSP).

Details

• Required to work flexible timings.
• Location: Gurgaon, India.