SIEM Rule Engineer

About the Role

Responsibilities

Rule Engineering & Detection Content Development

• Develop and maintain correlation rules, signatures, and detection logic in SIEM platforms such as Splunk, ELK, and QRadar, along with IDS/IPS tools such as Suricata and Snort, and EDR platforms such as Wazuh.
• Translate MITRE ATT&CK techniques into effective detection rules.
• Tune existing rules to reduce false positives and false negatives while improving detection accuracy.
• Implement YARA, Sigma, or custom detection formats based on platform requirements.

Threat Intelligence Integration

• Collaborate with Threat Intelligence and Incident Response teams to operationalize Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs).
• Create enrichment pipelines using threat feeds such as STIX/TAXII, MISP, and similar platforms.

SOC Automation & Optimization

• Integrate rule alerts with SOAR platforms to enable automated response workflows.
• Ensure all rules follow proper version control and documentation practices using tools such as Git.
• Conduct regression testing of detection rules during platform upgrades and updates.

Monitoring & Analytics

• Continuously monitor and evaluate rule performance using telemetry and log data.
• Develop dashboards and reporting mechanisms for alert metrics, rule health, and detection coverage gaps.

Cross-functional Collaboration

• Work closely with blue teams, red teams, compliance teams, and application owners to refine detection use cases.
• Participate in purple teaming exercises and enhance rules based on post-attack simulations and findings.

Eligibility

• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, or a related field.
• 2–5 years of experience in a SOC, cyber threat detection, or security engineering role.
• Proficiency in writing SIEM rules, Suricata/Snort signatures, or similar detection logic.
• Strong understanding of MITRE ATT&CK, Cyber Kill Chain, and threat modeling methodologies.
• Hands-on experience with ELK Stack, Splunk, QRadar, or equivalent SIEM platforms.
• Familiarity with log sources such as Windows Event Logs, Sysmon, Zeek, Suricata, and firewall logs.

Desired Eligibility

• Knowledge of scripting languages such as Python or Bash for custom log parsing and enrichment.
• Experience with SOAR platforms such as Cortex XSOAR and Splunk SOAR.
• Experience with industrial protocols for OT environments, including Modbus, DNP3, and S7Comm.
• Exposure to cloud logging and detection platforms such as AWS CloudTrail and Azure Sentinel.
• Relevant certifications such as GCIA, GCED, GCTD, Splunk Certified, or Elastic Certified Analyst are preferred.

Travel

Communication