As a Security OperationsImplementationEngineer, you will be playing a pivotal role in enabling Zeta inimplementing and integrating SIEMs,detectingand responding to attacks at an early stage andmakesure infrastructure and applications are secure. You will work with an amazing peer group that fuels this ambition.
We are looking for a highly motivatedSIEM / SOC Engineerwith4-6 years of experience in developing, enhancing, andmaintainingenterprise-scale Security Operations and SIEM platforms based on theELK Stack (Elasticsearch, Logstash, Kibana). The candidate will play a key role in advancing our next-generation security monitoring capabilities by enhancing existing SIEM modules, developing new detection use cases, integrating security technologies such asUEBA, SOAR, Threat Intelligence, and supporting the SOC team with effective detection and response capabilities.
The ideal candidate shouldpossessstrong hands-on experience inlog parser development, security content engineering, ELK administration, AWS environments,microservicesarchitectures, and open-source security technologies.
Design, develop, andmaintainhigh-fidelity detection rules, correlation rules, alerts, and security use cases for newly onboarded and existing log sources. Continuously tune detections to reduce false positives, improve detection fidelity, and expand detection coverage across the environment.
Develop security monitoring and detection content for AWS services, Kubernetes, microservices, Linux, macOS, databases, web applications, firewalls, and other enterprise technologies byleveragingthe MITRE ATT&CK framework, threat intelligence, and adversary TTPs.
Onboard new security and application log sources by developing Logstash pipelines, custom parsers,Grokpatterns, ingest processors, and enrichment workflows. Analyze raw log formats, normalize events to a common schema, and enrich security telemetry to enable reliable detection and investigation.
Design andmaintainoperational dashboards, executive dashboards, SOC dashboards, and threat hunting visualizations using optimized OpenSearch Query DSL, aggregations, and visualizations to provide actionable security insights and platform observability.
Integrate Threat Intelligence Platforms (TIP), IOC feeds, and enrichment services with OpenSearch. Develop IOC correlation rules, automated enrichment workflows, and contextual detections toidentifymalicious activity across ingested telemetry.
Expand the SIEM by implementing advanced capabilities such as UEBA, anomaly detection, OpenSearch Notebooks for investigation playbooks, SOAR workflows for automated response, and AI-driven automation to streamline Level 1 SOC operations.
Collaborate with SOC analysts during alert investigations, threat hunting, and incident response by providing L2/L3 detection engineering support,validatingdetections,identifyingdetection gaps, and continuously improving existing security content.
Follow Detection-as-Code practices by developing, testing, version-controlling, and deploying detection content through Git-based workflows and CI/CD pipelines, ensuring consistent, reliable, and scalable delivery of SIEM content.
Hands-on experience with any enterprise SIEM platforms such as Elastic/ELK, OpenSearch, Splunk, Microsoft Sentinel, IBMQRadar, ArcSight, Google Chronicle,Wazuh,ELK/EFKor similar solutions.
Experience developing,maintaining, and tuning detection rules, correlation rules, alerts, dashboards, visualizations, and security use cases using SIEM query languages and detection frameworks such as OpenSearch/Elasticsearch Query DSL, Sigma, KQL, SPL, EQL, or equivalent.
Strong experience onboarding log sources by developing custom parsers, Logstash pipelines,Fluentd/Fluent Bit configurations, Grok patterns, ETL pipelines, field mappings, log normalization, and data enrichment workflows.
4-6 years of experience in Detection Engineering, SIEM Engineering, Security Operations, or SOC environments.
Good understanding of SIEM architecture, event correlation, log management, detection engineering, the MITRE ATT&CK framework, Cyber Kill Chain, threat hunting methodologies, attacker TTPs, Threat Intelligence integration, and IOC-based detections.
Experience developing detections and investigating security events across Linux, macOS, databases, web applications, firewalls, WAFs, enterprise infrastructure, and cloud environments.
Familiarity with open-source security technologies such asWazuh, Suricata, Zeek (Bro), Velociraptor, HELK, EFK, Falco,osquery, or similar security monitoring solutions.
Strong foundationin computer networking, operating systems, authentication and authorization concepts, web technologies, and common attack techniques.
Familiarity with YARA rules, malware detection concepts, and security automation is an added advantage.
Strong analytical, troubleshooting, and investigative skills with the ability toidentifydetection gaps,validatedetections, and continuously improve security monitoring content.
Hands-on experience with AWS environments and a good understanding of core AWS services such as IAM, CloudTrail, VPC, EC2, EKS, S3, CloudWatch, and cloud security monitoring concepts.
Familiarity with Kubernetes, Helm, containerized workloads,microservicesarchitectures, and cloud-native security monitoring, Git, CI/CD Pipeline knowledge etc.
Every tech & IT company hiring across India — with AI match scores — on one live map.
Open the map →