{"id":2597917,"url":"https://alion.io/job/hcltech-sme-security-analysis-siem","title":"SME - Security Analysis, SIEM","company":{"id":225,"name":"HCLTech","domain":"hcltech.com","url":"https://alion.io/company/hcltech","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":21000,"max_usd":52000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":617},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Git","optional":false},{"name":"IAM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false}],"status":"live","first_seen_at":"2026-10-15T07:43:30Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-15T12:22:48Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Job Summary\nDivision Cybersecurity- AppSec Track SOC- Detection Engineering Level L3 Location Offshore (India) Years of Experience\n10+ years of experience in SIEM engineering, Splunk content development, detection engineering, SOC analytics, or threat-detection use cases. Responsibilities\nServe as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving Customer security detection content.\nTranslate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics.\nWork with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise.\nDesign and develop correlation searches, risk-based alerts, dashboards, analytic stories, reports, and investigation searches in Splunk.\nMaintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement.\nMap detections to MITRE ATT&CK; techniques, Client threat scenarios, control objectives, and relevant assets or business services.\nAnalyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes.\nSupport security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics.\nValidate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection.\nMaintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics.\nAutomate detection deployment, testing, version control, and content quality checks where feasible.\nMentor L2 analysts and provide technical reviews for detection-content changes. Technical Requirements\nExpert-level Splunk Search Processing Language, correlation searches, Enterprise Security, risk-based alerting, data models, CIM, macros, lookups, accelerated searches, and dashboards.\nStrong experience with Splunk Cloud and enterprise-scale security content engineering.\nExperience onboarding and validating telemetry from endpoint, identity, PAM, cloud, network, email, application, database, and security-control platforms.\nDeep knowledge of MITRE ATT&CK;, threat detection methodologies, attacker behavior, cyber kill chain, and common detection frameworks.\nExperience with detection-as-code, Git, CI/CD, unit testing, content validation, Python, REST APIs, and automation.\nAbility to analyze data quality, field normalization, sourcetypes, index strategy, parsing, latency, and ingestion reliability.\nExperience integrating threat intelligence, asset context, identity context, vulnerability data, and business criticality into detections.\nUnderstanding of SOC workflows, incident response, threat hunting, false-positive management, and detection-performance metrics.\nKnowledge of Sigma, YARA, KQL, EQL, or other detection languages is preferred. Soft Skills\nExcellent communication and presentation skills.\nStrong problem-solving and critical thinking skills.\nExceptional project management and organizational abilities.\nTeam collaboration and leadership skills.\nClient-focused approach with a commitment to delivering exceptional customer service. Certifications (Good to have) Good to have relevant certificates like (any of the below):\nSplunk Enterprise Security Certified Admin, Splunk Cloud Certified Admin, or Splunk Enterprise Certified Admin.\nGCIA, GCIH, GMON, CISSP, CySA+, or equivalent detection/security-operations certification is preferred. Educational Qualifications\nUniversity degree in IT or/and IT Security.\nBachelor’s degree in computer science/ IT or any relevant fields.\nKey Responsibilities\nDivision Cybersecurity- AppSec Track SOC- Detection Engineering Level L3 Location Offshore (India) Years of Experience\n10+ years of experience in SIEM engineering, Splunk content development, detection engineering, SOC analytics, or threat-detection use cases. Responsibilities\nServe as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving Customer security detection content.\nTranslate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics.\nWork with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise.\nDesign and develop correlation searches, risk-based alerts, dashboards, analytic stories, reports, and investigation searches in Splunk.\nMaintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement.\nMap detections to MITRE ATT&CK; techniques, Client threat scenarios, control objectives, and relevant assets or business services.\nAnalyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes.\nSupport security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics.\nValidate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection.\nMaintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics.\nAutomate detection deployment, testing, version control, and content quality checks where feasible.\nMentor L2 analysts and provide technical reviews for detection-content changes. Technical Requirements\nExpert-level Splunk Search Processing Language, correlation searches, Enterprise Security, risk-based alerting, data models, CIM, macros, lookups, accelerated searches, and dashboards.\nStrong experience with Splunk Cloud and enterprise-scale security content engineering.\nExperience onboarding and validating telemetry from endpoint, identity, PAM, cloud, network, email, application, database, and security-control platforms.\nDeep knowledge of MITRE ATT&CK;, threat detection methodologies, attacker behavior, cyber kill chain, and common detection frameworks.\nExperience with detection-as-code, Git, CI/CD, unit testing, content validation, Python, REST APIs, and automation.\nAbility to analyze data quality, field normalization, sourcetypes, index strategy, parsing, latency, and ingestion reliability.\nExperience integrating threat intelligence, asset context, identity context, vulnerability data, and business criticality into detections.\nUnderstanding of SOC workflows, incident response, threat hunting, false-positive management, and detection-performance metrics.\nKnowledge of Sigma, YARA, KQL, EQL, or other detection languages is preferred. Soft Skills\nExcellent communication and presentation skills.\nStrong problem-solving and critical thinking skills.\nExceptional project management and organizational abilities.\nTeam collaboration and leadership skills.\nClient-focused approach with a commitment to delivering exceptional customer service. Certifications (Good to have) Good to have relevant certificates like (any of the below):\nSplunk Enterprise Security Certified Admin, Splunk Cloud Certified Admin, or Splunk Enterprise Certified Admin.\nGCIA, GCIH, GMON, CISSP, CySA+, or equivalent detection/security-operations certification is preferred. Educational Qualifications\nUniversity degree in IT or/and IT Security.\nBachelor’s degree in computer science/ IT or any relevant fields.\nSkill Requirements\nDivision Cybersecurity- AppSec Track SOC- Detection Engineering Level L3 Location Offshore (India) Years of Experience\n10+ years of experience in SIEM engineering, Splunk content development, detection engineering, SOC analytics, or threat-detection use cases. Responsibilities\nServe as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving Customer security detection content.\nTranslate threat intelligence, incidents, attack techniques, control gaps, and security requirements into high-quality Splunk detections and analytics.\nWork with SOC, incident response, threat hunting, CTI, IAM/PAM, cloud, endpoint, network, and application teams to improve detection coverage and reduce alert noise.\nDesign and develop correlation searches, risk-based alerts, dashboards, analytic stories, reports, and investigation searches in Splunk.\nMaintain the detection lifecycle, including requirements, data validation, development, testing, tuning, deployment, documentation, review, and retirement.\nMap detections to MITRE ATT&CK; techniques, Client threat scenarios, control objectives, and relevant assets or business services.\nAnalyze false positives, missed detections, alert quality, detection gaps, and data-quality issues; implement tuning recommendations through approved change processes.\nSupport security incident investigations and threat hunts by creating complex searches, enrichment logic, and reusable analytics.\nValidate that required log sources, fields, data models, timestamps, and context are available and reliable for each detection.\nMaintain the detection/use-case catalogue, tuning history, validation evidence, testing outcomes, and coverage metrics.\nAutomate detection deployment, testing, version control, and content quality checks where feasible.\nMentor L2 analysts and provide technical reviews for detection-content changes. Technical Requirements\nExpert-level Splunk Search Processing Language, correlation searches, Enterprise Security, risk-based alerting, data models, CIM, macros, lookups, accelerated searches, and dashboards.\nStrong experience with Splunk Cloud and enterprise-scale security content engineering.\nExperience onboarding and validating telemetry from endpoint, identity, PAM, cloud, network, email, application, database, and security-control platforms.\nDeep knowledge of MITRE ATT&CK;, threat detection methodologies, attacker behavior, cyber kill chain, and common detection frameworks.\nExperience with detection-as-code, Git, CI/CD, unit testing, content validation, Python, REST APIs, and automation.\nAbility to analyze data quality, field normalization, sourcetypes, index strategy, parsing, latency, and ingestion reliability.\nExperience integrating threat intelligence, asset context, identity context, vulnerability data, and business criticality into detections.\nUnderstanding of SOC workflows, incident response, threat hunting, false-positive management, and detection-performance metrics.\nKnowledge of Sigma, YARA, KQL, EQL, or other detection languages is preferred. Soft Skills\nExcellent communication and presentation skills.\nStrong problem-solving and critical thinking skills.\nExceptional project management and organizational abilities.\nTeam collaboration and leadership skills.\nClient-focused approach with a commitment to delivering exceptional customer service. Certifications (Good to have) Good to have relevant certificates like (any of the below):\nSplunk Enterprise Security Certified Admin, Splunk Cloud Certified Admin, or Splunk Enterprise Certified Admin.\nGCIA, GCIH, GMON, CISSP, CySA+, or equivalent detection/security-operations certification is preferred. Educational Qualifications\nUniversity degree in IT or/and IT Security.\nBachelor’s degree in computer science/ IT or any relevant fields.\nOther Requirements\nDivision Cybersecurity- AppSec Track SOC- Detection Engineering Level L3 Location Offshore (India) Years of Experience\n10+ years of experience in SIEM engineering, Splunk content development, detection engineering, SOC analytics, or threat-detection use cases. Responsibilities\nServe as an L3 Splunk-heavy detection engineer responsible for developing, tuning, validating, and improving Customer security detection content.\nTranslate threat intelligence, incidents, attack techniques, co...","description_format":"text","description_chars":15326,"description_truncated":true,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Incident Response","IT Consulting & Digital Transformation","Systems Integrators"],"lifecycle":[{"event":"open","at":"2026-10-15T07:43:30Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":27,"reasons":["conf:3","win:early","comp:brand"],"computed_at":"2026-10-15T16:02:49Z"},"pay":null,"html_url":"https://alion.io/job/hcltech-sme-security-analysis-siem","json_url":"https://alion.io/job/hcltech-sme-security-analysis-siem.json","meta":{"generated_at":"2026-10-15T16:02:49Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24460,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":225},"rest":"https://alion.io/mcp/rest/get_company?id=225"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhcltech-sme-security-analysis-siem"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhcltech-sme-security-analysis-siem"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhcltech-sme-security-analysis-siem"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/hcltech-sme-security-analysis-siem\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhcltech-sme-security-analysis-siem"}]}