Security Engineer III -SOC

Overview

Security Engineer III on Anaplan's Security Operations team, designing, building and enhancing technical capabilities for threat detection, investigation and response, bridging engineering and operations.

What you'll do

• Manage the SIEM platform, onboard and normalize log sources, build and maintain parsers, and ensure high-fidelity data pipelines for detection and investigation.
• Develop and maintain a library of high-quality detections using a Detection as Code approach, managing content through version control, peer review and automated testing.
• Align detections with the MITRE ATT&CK framework to enhance coverage, precision and resilience.
• Create and maintain automated workflows and playbooks using SOAR platforms to optimize alert triage, enrichment and response.
• Identify and automate manual security operations processes to enhance scalability.
• Investigate and implement AI and machine learning to boost security operations, including alert triage, incident response, threat intelligence analysis and detection content enrichment.
• Integrate threat intelligence and adversary context into detection logic, SOAR playbooks and hunting activities.
• Conduct proactive, hypothesis-driven threat hunts and document findings to inform detection engineering and tools.
• Provide engineering support during security incidents, aiding investigation, containment and recovery, and contribute to post-incident reviews.

What you'll need

• Extensive experience in security engineering, DevSecOps or a similar role, particularly securing cloud-native environments and modern application stacks.
• Practical experience developing and tuning SIEM detections, writing threat hunting queries and engaging in incident response.
• Proficiency administering and operating core security tools such as SIEM platforms (e.g., Splunk, Microsoft Sentinel), EDR/XDR solutions and vulnerability scanners, with experience integrating them for detection and response workflows.
• Familiarity with threat intelligence platforms and feeds (e.g., MISP, Recorded Future, VirusTotal) and the ability to integrate intelligence into security tooling and detection logic.
• Proficiency in scripting or programming languages (e.g., Python, Go, Bash) for building security tools and automating workflows.
• Understanding of secure development practices, OWASP top risks, and experience in code reviews or collaborating with developers to address security findings.
• Knowledge of security frameworks and standards (e.g., NIST CSF, CIS Benchmarks, MITRE ATT&CK) and compliance standards such as SOC 2 or ISO 27001.
• Strong ability to communicate technical security risks and recommendations to diverse stakeholders and work cross-functionally.
• Experience leading or supporting security incident investigations, including evidence preservation, log analysis, timeline reconstruction and root cause identification.

Nice to have

• Knowledge of threat hunting methodologies.
• Familiarity with forensic tools and methodologies.

Details

• Location: Gurugram, India.