Security Engineer III

We are looking for a Security Engineer III to join the Critical Start Technologies Private Ltd. team, operating under the Critical Start umbrella, supporting our India operations. This is an exciting opportunity for a skilled security professional with 5–8 years of hands-on experience in security engineering, threat detection, and investigation. We are looking for a curious, technically adept individual who thrives in a fast-paced, high-impact environment. You bring deep technical expertise, a proactive mindset, and a passion for solving complex security challenges using industry-leading tools and frameworks.
The ideal candidate is a driven and resourceful security professional who thrives on diving deep into threat activity—whether it’s analyzing port scans or crafting custom detection queries. With a strong understanding of the MITRE ATT&CK framework, you’re capable of building your own detection content and conducting investigations independently, without relying solely on predefined rules. You take initiative, enjoy improving processes, and excel in autonomous, project-based environments. Your analytical mindset, technical curiosity, and collaborative spirit enable you to contribute meaningfully to both team goals and larger security objectives.

• Investigate and validate alerts generated by industry-standard EDR and SIEM platforms, ensuring data quality and investigative clarity for our Security Operations Center (SOC).
• Proactively identify opportunities to improve alert fidelity through detection tuning, custom rule development, and the creation of IOCs and IOAs.
• Author and maintain clear, user-centric investigation procedures to guide SOC analysts and drive consistency in alert handling.
• Collaborate cross-functionally with Engineering and Product teams to enhance security tools and improve platform efficacy.
• Conduct periodic quality assurance checks on alerts—especially during platform updates or vendor API changes—to maintain actionable fidelity.
• Design, write, and translate threat detection content across tools including but not limited to Splunk, Microsoft Sentinel, Devo, Microsoft 365 Defender, Palo Alto Cortex XDR, CrowdStrike, and SentinelOne.
• Lead internal knowledge-sharing sessions and mentor junior team members to foster a culture of collaboration and continuous learning.
• Operate effectively in a global, agile team spanning multiple time zones, balancing independence with team collaboration.

• 5+ years of experience in cybersecurity with a focus on threat detection, security engineering, or incident investigation.
• Hands-on experience with multiple EDR and SIEM tools such as Splunk, Microsoft Sentinel, Devo, Microsoft 365 Defender, Palo Alto Cortex XDR, CrowdStrike, SentinelOne, Carbon Black, or Cylance.
• Proficiency in one or more query languages (e.g., SPL, KQL, Sumo Logic).
• Experience building use cases for SIEM platforms and a solid grasp of log source types including firewalls, operating systems, and proxies.
• Strong verbal and written communication skills with the ability to convey complex concepts to both technical and non-technical stakeholders.
• Ability to work independently while effectively collaborating with distributed teams.
• Familiarity with tools like GitHub, Jira, and Confluence.

• Professional certifications such as OSCP, CISSP, or equivalent.
• Experience creating parsers or custom log processing logic.
• Exposure to agile development environments and DevSecOps culture.