Principal Security Architect - SIEM/Endpoint Detection & Response

Compensation

Not disclosed

Location

Hyderabad

Work setup

Onsite

Seniority

Principal

Employment

Not specified

Experience

9+ years

Skills

automation
ccnp
cissp
cloud
cloud-security
crowdstrike
edr
microsoft-sentinel
powershell
python
siem
splunk
threat-hunting
threat-intelligence

Must have

- Strong hands-on experience with SIEM platforms such as Splunk, Microsoft Sentinel, or LogRhythm.
- Experience working with EDR solutions like CrowdStrike.
- Expertise in Detection Engineering, Threat Hunting, and Security Monitoring.
- Good understanding of log collection and aggregation technologies such as Syslog, Syslog-NG, NxLog, and Windows Event Forwarding.
- Experience with SOAR integrations and security automation.
- Strong understanding of MITRE ATT&CK framework and attack methodologies.
- Scripting knowledge in Python or PowerShell.
- Experience in Cloud Security environments.
- Strong troubleshooting, debugging, and analytical skills.

Nice to have

- Experience in large-scale enterprise security environments.
- Relevant certifications such as CISSP, CCNP Security, or equivalent.

Full description

Hiring : Principal Security Architect SIEM & EDR

Experience : 9 to 12 Years

Location : Hyderabad (WFO)

Job Description :

We are looking for a highly skilled Principal Security Architect with strong hands-on experience in SIEM Engineering, EDR, Security Automation, and Cloud Security. The ideal candidate should have expertise in architecting, implementing, and scaling enterprise security monitoring and detection platforms in high-volume environments.

Key Responsibilities :

Design and implement log ingestion, parsing, normalization, and integration across multiple security platforms.

Build and enhance SIEM detection rules, dashboards, alerts, playbooks, and automation workflows.

Integrate SIEM platforms with EDR, SOAR, Threat Intelligence, and ticketing systems.

Develop custom scripts, actions, and integrations to extend SIEM platform capabilities.

Optimize SIEM performance, scalability, and alert correlation to reduce alert fatigue.

Lead deployment, operation, and maintenance of enterprise EDR platforms.

Collaborate with SOC, Threat Hunting, and Incident Response teams for investigations and response activities.

Support cloud security initiatives and security monitoring improvements.

Create and maintain technical documentation, workflows, and operational procedures.

Required Skills :

Strong hands-on experience with SIEM platforms such as Splunk, Microsoft Sentinel, or LogRhythm.

Experience working with EDR solutions like CrowdStrike.

Expertise in Detection Engineering, Threat Hunting, and Security Monitoring.

Good understanding of log collection and aggregation technologies such as Syslog, Syslog-NG, NxLog, and Windows Event Forwarding.

Experience with SOAR integrations and security automation.

Strong understanding of MITRE ATT&CK framework and attack methodologies.

Scripting knowledge in Python or PowerShell.

Experience in Cloud Security environments.

Strong troubleshooting, debugging, and analytical skills.

Preferred Qualifications :

Experience in large-scale enterprise security environments.

Relevant certifications such as CISSP, CCNP Security, or equivalent.