SIEM Rule Engineer

About the Role The SIEM Rule Engineer will be responsible for designing, developing, testing, and tuning detection rules, signatures, and alerts for SIEM, IDS/IPS, and other monitoring platforms. This role focuses on enhancing threat detection capabilities by translating threat intelligence, attack patterns, and security use cases into actionable and accurate detections. Responsibilities Rule Engineering & Detection Content Development Develop and maintain correlation rules, signatures, and detection logic in SIEM platforms such as Splunk, ELK, and QRadar, along with IDS/IPS tools such as Suricata and Snort, and EDR platforms such as Wazuh. Translate MITRE ATT&CK techniques into effective detection rules. Tune existing rules to reduce false positives and false negatives while improving detection accuracy. Implement YARA, Sigma, or custom detection formats based on platform requirements. Threat Intelligence Integration Collaborate with Threat Intelligence and Incident Response teams to operationalize Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs). Create enrichment pipelines using threat feeds such as STIX/TAXII, MISP, and similar platforms. SOC Automation & Optimization Integrate rule alerts with SOAR platforms to enable automated response workflows. Ensure all rules follow proper version control and documentation practices using tools such as Git. Conduct regression testing of detection rules during platform upgrades and updates. Monitoring & Analytics Continuously monitor and evaluate rule performance using telemetry and log data. Develop dashboards and reporting mechanisms for alert metrics, rule health, and detection coverage gaps. Cross-functional Collaboration Work closely with blue teams, red teams, compliance teams, and application owners to refine detection use cases. Participate in purple teaming exercises and enhance rules based on post-attack simulations and findings. Eligibility Bachelor’s or Master’s degree in Cybersecurity, Computer Science, or a related field. 2–5 years of experience in a SOC, cyber threat detection, or security engineering role. Proficiency in writing SIEM rules, Suricata/Snort signatures, or similar detection logic. Strong understanding of MITRE ATT&CK, Cyber Kill Chain, and threat modeling methodologies. Hands-on experience with ELK Stack, Splunk, QRadar, or equivalent SIEM platforms. Familiarity with log sources such as Windows Event Logs, Sysmon, Zeek, Suricata, and firewall logs. Desired Eligibility Knowledge of scripting languages such as Python or Bash for custom log parsing and enrichment. Experience with SOAR platforms such as Cortex XSOAR and Splunk SOAR. Experience with industrial protocols for OT environments, including Modbus, DNP3, and S7Comm. Exposure to cloud logging and detection platforms such as AWS CloudTrail and Azure Sentinel. Relevant certifications such as GCIA, GCED, GCTD, Splunk Certified, or Elastic Certified Analyst are preferred. Travel Travel may be required across the country for project execution, monitoring, and coordination with geographically distributed teams, as and when required. Communication Submit a cover letter summarising your experience in relevant technologies and software, along with your resume and latest passport-size photograph.