Principal Content Developer - SIEM Platform

7 years

0 Lacs

Posted:3 days ago| Platform: Linkedin logo

Apply

Work Mode

On-site

Job Type

Full Time

Job Description

Key Responsibilities

  • Architect, develop, and optimize detection content across SIEM platforms such as Microsoft Sentinel, Splunk, and Google Chronicle.
  • Normalize and structure diverse log sources using schemas like Splunk CIM, Microsoft Sentinel, OCSF, and Chronicle UDM to ensure consistent detection across the board.
  • Collaborate with teams including Threat Labs and Data Engineering to improve parsing, data transformation, and use case configurations.
  • Perform end-to-end development, customization, and onboarding of supported and custom data sources (EDR, firewall, antivirus, proxies, OS, databases).
  • Repair events with missing or incorrect data, create parser extensions, and manage flow logic for log ingestion pipelines.
  • Conduct log source analysis and maintain robust documentation of data structures, parsing rules, and detection logic.
  • Build and maintain monitoring reports to ensure data pipeline availability and proactively identify performance issues or gaps in data coverage.
  • Continuously evaluate and refine detection content and parsing logic for high fidelity and low false-positive rates.

Required Qualifications

  • 7+ years of experience in security engineering, detection content development, or SIEM management.
  • Strong hands-on experience with SIEM platforms, particularly Microsoft Sentinel, Splunk, and Chronicle.
  • Expertise with multiple data models including Splunk CIM, Sentinel schemas, Chronicle UDM, and OCSF.
  • Experience working with diverse log sources (e.g., EDRs, firewalls, antivirus, proxies, databases, OS logs).
  • Skilled in event parsing, field extraction, normalization, and enrichment for log data.
  • Familiarity with scripting/query languages such as KQL, SPL, and UDM search syntax.
  • Strong understanding of SOC operations, detection engineering workflows, and threat modeling frameworks (MITRE ATT&CK, etc.).

Preferred Qualifications

  • Experience working with cloud-native and hybrid security architectures.
  • Familiarity with data transformation tools and stream processing pipelines.
  • Previous collaboration with threat research or threat intelligence teams.
  • Security certifications such as GCIA, GCTI, or similar are a plus.
(ref:hirist.tech)

Mock Interview

Practice Video Interview with JobPe AI

Start Job-Specific Interview
cta

Start Your Job Search Today

Browse through a variety of job opportunities tailored to your skills and preferences. Filter by location, experience, salary, and more to find your perfect fit.

Job Application AI Bot

Job Application AI Bot

Apply to 20+ Portals in one click

Download Now

Download the Mobile App

Instantly access job listings, apply easily, and track applications.

coding practice

Enhance Your Skills

Practice coding challenges to boost your skills

Start Practicing Now

RecommendedJobs for You