Lead Engineer - SIEM & Detection Platforms
AstraZeneca6 days ago
Chennai, IndiaStaff+
Responsibilities
- Lead end-to-end enterprise detection engineering initiatives across SIEM, EDR, NDR, cloud, on-premises, and OT/ICS environments.
- Build, optimize, govern, and map detection content to adversary tactics, techniques, and procedures.
- Tune detection platforms and queries to improve signal quality, reduce false positives, and limit alert fatigue.
- Assess threat coverage, identify detection gaps, and develop detections for emerging techniques.
- Introduce behavioral analytics, machine learning, detection-as-code, scripting, and orchestration automation.
- Define detection engineering standards, development methodologies, quality controls, and measurable performance benchmarks.
- Partner with SOC, incident response, threat intelligence, offensive security, engineering teams, suppliers, and platform vendors.
- Lead purple-team validation and convert adversary-emulation findings into improved detection coverage.
Requirements
- Bachelor's degree in information security, computer science, or a related field, or equivalent experience.
- At least five years of detection engineering experience, preferably in security operations centers or detection engineering teams.
- At least five years of hands-on experience with enterprise SIEM, EDR, NDR, and cloud-native security platforms.
- At least three years of experience using Python, PowerShell, or similar scripting languages for detection development and automation.
- At least three years of experience with standardized detection formats such as Sigma rules, YARA signatures, and platform-specific query languages.
- Deep expertise in detection logic, threat modeling, coverage mapping, platform query optimization, tuning, and false-positive reduction.
- Comprehensive familiarity with MITRE ATT&CK, Cyber Kill Chain, detection engineering methods, threat intelligence, and adversary TTPs.
- Experience with detection-as-code, version control, purple teaming, offensive-security collaboration, and enterprise-scale detection initiatives.
- Familiarity with OT/ICS detection constraints, safety implications, availability requirements, and threats across cloud, on-premises, and industrial environments.
- Experience collaborating across global, matrixed organizations with security operations, incident response, threat intelligence, suppliers, and vendors.
- Relevant certifications such as GIAC GCIA, GCDA, GMON, platform-specific certifications, or threat-hunting certifications are preferred.
Benefits
- Average minimum of three days per week in the office in Chennai, with flexibility around the in-person working expectation.
- Opportunity to work with modern security platforms, global experts, and a network focused on protecting life-changing medicines.
- Equal opportunity employer with reasonable accommodation available for individuals with disabilities.
About AstraZeneca
AstraZeneca is a global biopharmaceutical company that discovers, develops, manufactures, and commercializes prescription medicines for patients and healthcare systems. Its portfolio spans oncology, cardiovascular, renal and metabolism, respiratory and immunology, and rare diseases (expanded by the 2021 acquisition of Alexion). Founded in 1999 and headquartered in Cambridge, UK, it is a public company listed on the London Stock Exchange and Nasdaq, generating revenue primarily from drug sales and partnerships.