IN-AssociateSIEMDigital IntegrationAdvisoryKolkata

About the Role

Werelooking for an early-career SIEM Engineer to join our Global SIEM team and help drive the next phase of our security analytics and observability journey. You will be hands-on withSplunk (Enterprise/Cloud/ES)andCribl(Stream/Edge)to onboard normalize andoptimizesecurity data while building/maintainingdetections dashboards and automations that support our SOC Threat Hunting and Incident Response teams.

Youllthrive here if you enjoy crafting robust data pipelines writing efficient SPL applying security frameworks (MITRE ATT&CK NIST) and continuously improving signal quality and time-to-detect/resolve.

Responsibilities

Platform & Data Engineering

• Onboard new log sources (network endpoint identity cloud SaaS) intoSplunkviaCribl(Stream/Edge) ensuring secure reliable and cost-optimized ingestion.

• Build and manageCriblpipelines(parsing shaping routing redaction filtering sampling) aligned to data retention and ingest budgets.

• Implement and maintainSplunk data models CIM mappingssourcetypes index strategies HEC tokens and ingestion best practices.

• Monitor andoptimizesearch performance (SPL tuning data model acceleration summary indexing KV stores lookup strategies).

Detection Content & Operations

• Develop tune andmaintaincorrelation searchesand detections inSplunk Enterprise Security(includingRisk-Based Alerting).

• Build operational and executivedashboards reports and analytics for SOC and leadership stakeholders.

• Maintain runbooks field extractions (regex) data quality checks and use case documentation.

Security Mindset & Collaboration

• ApplyMITRE ATT&CKmapping threat modeling and basic threat hunting practices to refine use cases and reduce false positives.

• Partner closely withSOC Analysts Threat Hunters IR Cloud/SRE and Application Ownersto improve detection coverage and response workflows.

• Contribute to purple team exercises and lessons learned to elevate controls and detections.

Required Qualifications

• 23 yearsof hands-on experience withSplunk(Enterprise/Cloud/ES) in security logging detection engineering or SIEM operations.

• Working knowledge ofCribl(Stream and/or Edge) for data routing transformation and optimization.

• Solid SPL skills: joins stats/timechart eval rex transactiondatamodeltstatsmstats.

• Familiarity withCIM data models and security-relevant log sources (EDRfirewall proxy DNS identity cloud).

• Understanding ofcore security concepts:authentication flows network fundamentals common attack techniques andincident response basics.

• Experience withLinux fundamentalsGit-based content management and scripting for automation (bash or Python preferred).

• Strong communication documentation and cross-time-zone collaboration skills.

Preferred Certifications (one or more)

Equivalent or higher-level credentials are welcome.

Splunk

• Splunk Core CertifiedPower User

• Splunk Core CertifiedAdmin

• Splunk Enterprise SecurityCertified Admin(nice to have)

• SplunkCloud Admin(nice to have)

Cribl

• CriblCertified Observability Engineer (CCOE) Stream

• CriblCertified Observability Engineer Edge(nice to have)

Security

• SecurityCySA orGSEC(or equivalent)

• Familiarity withMITRE ATT&CKNIST CSF/800-53ISO 27001

Nice-to-Have Skills

• Experience withrisk-based alerting entity analytics/UEBA or threat hunting content.

• Cloud and SaaS logging:AWS(CloudTrail/GuardDuty/S3)Azure(Event Hub/Graph/Defender)GCP(Audit/Cloud Logging)OktaM365(Graph/Security Center).

• Observability crossover: metrics/logs/tracesOpenTelemetry S3/object storage targets syslog/TLS HEC Kafka.

• Familiarity withSOAR(e.g. Splunk SOAR) for playbooks and enrichment automation.

• Knowledge ofregexYAML/JSONpipelines and API-based integrations.

• Exposure tocompliance/reporting (PCI-DSS ISO 27001 SOC2).

Success Metrics (What Good Looks Like)

• Time-to-Onboardnew data sources (meeting quality and CIM standards).

• Signal Quality: reduction in false positives; improved precision/recall of detections.

• Performance & Cost:searchlatency improvements efficient data model usage andoptimizedingest/storage.

• Operational Excellence: documented runbooks reliable handoffs and on-time closure of engineering backlog.

• Stakeholder Satisfactionfrom SOC/IR and platform owners.