Job Summary
The Track Lead (Support & Operations) plays a pivotal role in managing security event investigations and implementing technical solutions within the organization. This position focuses on enhancing operational efficiencies, ensuring client satisfaction, and fostering a culture of continuous improvement and innovation among teams. The Track Lead is instrumental in aligning operational goals with organizational objectives while empowering teams to meet client SLAs effectively.
We are looking for an experienced Detection Engineer with strong Splunk, Risk-Based Alerting, and Security Analytics background to design, develop, tune, and maintain advanced cyber threat detections across enterprise environments.
The role will focus on developing high-fidelity detections using Splunk SPL, Splunk Enterprise Security, Risk-Based Alerting, MITRE ATT&CK mapping, and data-driven analytics. The candidate should also have exposure to Python, Pandas, Scikit-learn, statistical analysis, anomaly detection, clustering, and machine learning exploration to support behavioral analytics and threat detection maturity.
The ideal candidate will work closely with SOC analysts, threat hunters, incident responders, threat intelligence teams, and security engineering teams to reduce false positives, improve detection coverage, and operationalize risk-based security monitoring.
Key Responsibilities
1. Implement And Optimize Soar Solutions To Automate Security Event Investigations, Ensuring Timely And Accurate Incident Response While Enhancing Overall Operational Efficiency.
2. Develop And Maintain Comprehensive Reporting Systems Using Siem Tools To Provide Insights Into Security Incidents And Operational Performance, Facilitating Informed Decision-Making.
3. Lead And Mentor The Support Team By Fostering Transparent Communication Of Project Goals And Encouraging The Adoption Of Best Practices In Security Operations.
4. Collaborate With Clients To Thoroughly Understand Their Security Needs, Ensuring The Support Team Delivers Tailored Solutions That Exceed Client Expectations.
5. Drive Innovation By Identifying Opportunities For Process Improvements And Implementing New Ideas That Enhance The Effectiveness Of Security Operations.
1. Detection Engineering
- Design, develop, test, tune, and maintain security detections using Splunk SPL.
- Build and manage Splunk Enterprise Security correlation searches.
- Develop detection use cases across endpoint, network, identity, cloud, email, proxy, DNS, VPN, and application logs.
- Convert threat intelligence, attack patterns, and SOC findings into actionable detection logic.
- Map detections to MITRE ATT&CK tactics, techniques, and procedures.
- Perform detection testing using historical data, attack simulation, purple team exercises, and threat hunting findings.
- Reduce false positives through tuning, threshold adjustment, suppression logic, and contextual enrichment.
- Create and maintain detection documentation including logic, severity, risk score, data sources, MITRE mapping, and investigation steps.
2. Splunk Enterprise Security & SIEM Operations
- Develop and optimize correlation searches, notable events, dashboards, reports, and alerts in Splunk Enterprise Security.
- Work with Splunk data models, CIM mapping, accelerated data models, and tstats queries.
- Support log source validation, parsing, field extraction, and data quality reviews.
- Create dashboards for SOC monitoring, detection health, alert trends, and risk posture.
- Support SOC analysts with investigation queries, timelines, and alert triage improvements.
- Integrate Splunk detections with SOAR, ticketing, and case management platforms where applicable.
3. Risk-Based Alerting & Risk Analytics
- Design and maintain Risk-Based Alerting rules in Splunk Enterprise Security.
- Assign contextual risk scores to users, hosts, source IPs, destination IPs, cloud identities, service accounts, and applications.
- Build risk rules for authentication anomalies, privileged activity, suspicious process execution, lateral movement, malware indicators, data exfiltration, cloud misconfigurations, and insider-risk behavior.
- Develop cumulative risk scoring logic to identify high-risk users, hosts, and sessions.
- Correlate multiple low-severity events into high-confidence notable alerts.
- Tune risk thresholds based on alert volume, business context, entity criticality, and SOC feedback.
Skill Requirements
2. In-Depth Knowledge Of Siem Tools And Their Application In Operational Environments.
3. Excellent Problem-Solving Abilities And A Strong Understanding Of Client Relationship Management.
4. Proven Leadership Skills With The Ability To Mentor And Empower Teams Effectively.