IN-Senior Associate_SIEM Engineer (Global Operations) – Splunk & Cribl_Digital Integration_Advisory_Kolkata

job Description & summary:

We’re looking for an early-career SIEM Engineer to join our Global SIEM team and help drive the next phase of our security analytics and observability journey. You will be hands-on with Splunk (Enterprise/Cloud/ES) and Cribl (Stream/Edge) to onboard, normalize, and optimize security data, while building/maintaining detections, dashboards, and automations that support our SOC, Threat Hunting, and Incident Response teams.

You’ll thrive here if you enjoy crafting robust data pipelines, writing efficient SPL, applying security frameworks (MITRE ATT&CK, NIST), and continuously improving signal quality and time-to-detect/resolve.

Onboard new log sources (network, endpoint, identity, cloud, SaaS) into Splunk via Cribl (Stream/Edge), ensuring secure, reliable, and cost-optimized ingestion.

• Build and manage Cribl pipelines (parsing, shaping, routing, redaction, filtering, sampling) aligned to data retention and ingest budgets.
• Implement and maintain Splunk data models, CIM mappings, sourcetypes, index strategies, HEC tokens, and ingestion best practices.
• Monitor and optimize search performance (SPL tuning, data model acceleration, summary indexing, KV stores, lookup strategies).

Detection, Content & Operations

• Develop, tune, and maintain correlation searches and detections in Splunk Enterprise Security (including Risk-Based Alerting).
• Build operational and executive dashboards, reports, and analytics for SOC and leadership stakeholders.
• Maintain runbooks, field extractions (regex), data quality checks, and use case documentation.

Security Mindset & Collaboration

• Apply MITRE ATT&CK mapping, threat modeling, and basic threat hunting practices to refine use cases and reduce false positives.
• Partner closely with SOC Analysts, Threat Hunters, IR, Cloud/SRE, and Application Owners to improve detection coverage and response workflows.
• Contribute to purple team exercises and lessons learned to elevate controls and detections.

Required Qualifications

• 2–3 years of hands-on experience with Splunk (Enterprise/Cloud/ES) in security logging, detection engineering, or SIEM operations.
• Working knowledge of Cribl (Stream and/or Edge) for data routing, transformation, and optimization.
• Solid SPL skills: joins, stats/timechart, eval, rex, transaction, datamodel, tstats, mstats.
• Familiarity with CIM, data models, and security-relevant log sources (EDR, firewall, proxy, DNS, identity, cloud).
• Understanding of core security concepts: authentication flows, network fundamentals, common attack techniques, and incident response basics.
• Experience with Linux fundamentals, Git-based content management, and scripting for automation (bash or Python preferred).
• Strong communication, documentation, and cross-time-zone collaboration skills.

Preferred Certifications (one or more)

Equivalent or higher-level credentials are welcome.

Splunk

• Splunk Core Certified Power User
• Splunk Core Certified Admin
• Splunk Enterprise Security Certified Admin (nice to have)
• Splunk Cloud Admin (nice to have)

Cribl

• Cribl Certified Observability Engineer (CCOE) – Stream
• Cribl Certified Observability Engineer – Edge (nice to have)

Security

• Security+, CySA+, or GSEC (or equivalent)
• Familiarity with MITRE ATT&CK, NIST CSF/800-53, ISO 27001

Nice-to-Have Skills

• Experience with risk-based alerting, entity analytics/UEBA, or threat hunting content.
• Cloud and SaaS logging: AWS (CloudTrail/GuardDuty/S3), Azure (Event Hub/Graph/Defender), GCP (Audit/Cloud Logging), Okta, M365 (Graph/Security Center).
• Observability crossover: metrics/logs/traces, OpenTelemetry, S3/object storage targets, syslog/TLS, HEC, Kafka.
• Familiarity with SOAR (e.g., Splunk SOAR) for playbooks and enrichment automation.
• Knowledge of regex, YAML/JSON pipelines, and API-based integrations.
• Exposure to compliance/reporting (PCI-DSS, ISO 27001, SOC2).

Success Metrics (What Good Looks Like)

• Time-to-Onboard new data sources (meeting quality and CIM standards).
• Signal Quality: reduction in false positives; improved precision/recall of detections.
• Performance & Cost: search latency improvements, efficient data model usage, and optimized ingest/storage.
• Operational Excellence: documented runbooks, reliable handoffs, and on-time closure of engineering backlog.
• Stakeholder Satisfaction from SOC/IR and platform owners.