{"id":3386607,"url":"https://alion.io/job/rackspace-technology-security-engineer-iii-in","title":"Security Engineer III - IN","company":{"id":46166,"name":"Rackspace Technology","domain":"rackspace.com","url":"https://alion.io/company/rackspace","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":88,"open_postings":8,"ghost_share":0.125,"stale_share":0.125,"repost_share":0.125,"time_to_fill_p50_days":29,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Gurgaon, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":14500,"max_usd":35000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":854},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Elastic SIEM","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"SIEM","optional":false},{"name":"Akamai","optional":true},{"name":"Amazon ECS","optional":true},{"name":"Ansible","optional":true},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"Azure DevOps","optional":true},{"name":"CI/CD","optional":true},{"name":"CircleCI","optional":true},{"name":"Cloudflare","optional":true},{"name":"Crowdstrike","optional":true},{"name":"DLP","optional":true},{"name":"ElasticSearch","optional":true},{"name":"GCP","optional":true},{"name":"GitHub Actions","optional":true},{"name":"Google SecOps","optional":true},{"name":"IBM QRadar","optional":true},{"name":"ISO 27001","optional":true},{"name":"JavaScript","optional":true},{"name":"Jenkins","optional":true},{"name":"Kibana","optional":true},{"name":"Logstash","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"Microsoft Defender for Cloud","optional":true},{"name":"OWASP","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Splunk","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-10-28T07:56:46Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-10-30T19:05:23Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Rackspace Security (Public Cloud)\nSIEM Engineer L3 (Sentinel + Elastic)\nAbout Rackspace Cyber Defence\nRackspace Cyber Defence is our next generation cyber defence and security operations capability that builds on 20+ years of securing customer environments to deliver proactive, risk-based, threat-informed and intelligence driven security services.\nOur purpose is to enable our customers to defend against the evolving threat landscape across on-premises, private cloud, public cloud and multi-cloud workloads.\nOur goal is to go beyond traditional security controls to deliver cloud-native, DevOps-centric and fully integrated 24x7x365 cyber defence capabilities that deliver a proactive, threat-informed, risk-based, intelligence-driven approach to detecting and responding to threats.\nOur mission is to help our customers:\nProactively detect and respond to cyber-attacks - 24x7x365.\nDefend against new and emerging risks that impact their business.\nReduce their attack surface across private cloud, hybrid cloud, public cloud, and multi-cloud environments.\nReduce their exposure to risks that impact their identity and brand.\nDevelop operational resilience.\nMaintain compliance with legal, regulatory and compliance obligations.\nKey Accountabilities\nAssist with customer onboarding by configuring and integrating data feeds into SIEM platforms with primary focus on Microsoft Sentinel and Elastic Security. Good to have experience in Splunk, IBM QRadar, and Google SecOps (Chronicle)\nEnsure the Customer’s operational and production environment remains healthy and secure at all the times.\nOnboard and integrate on-premises and cloud resources into Elastic SIEM, MS Sentinel, ensuring reliable security log ingestion, parsing, and monitoring.\nDevelop custom dashboards and reporting templates.\nDevelop complex to customer specific use cases.\nAdvance platform administration, ideally through a DevOps-centric approach.\nSolution recommendation for issues.\nCo-ordinate with vendor for issue resolution.\nBasic and Intermediate Playbook and workflow enhancement.\nMaintain close working relationships with relevant teams and individual key stakeholders, such as incident response and disaster recovery teams as well as information security etc.\nDevelop the custom parsers for the Incident and alert enrichment.\nProblem specific playbook and workflow creation and enhancements\n· Required to work flexible timings.\nSkills & Experience\nShould have relevant experience of 8+ years.\nProven experience in administering, configuring, and supporting Microsoft Sentinel and Elastic Security (Elastic SIEM) in large-scale cloud and enterprise environments, with the ability to independently manage SIEM operations, onboarding, integrations, and troubleshooting.\nElastic SIEM / Elastic Security (mandatory): Strong hands-on expertise in Elasticsearch, Kibana, Elastic Agent, Fleet, Logstash, data ingestion, integration management, parsing, ECS normalization, detection rules, alerts, dashboards, and incident investigation.\nCloud Security Monitoring: Experience integrating and monitoring security logs from Microsoft Azure, Microsoft 365, GCP and AWS environments within Elastic Security.\nMicrosoft Security Integration: Experience onboarding and analyzing security telemetry from Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Defender for Cloud, and Microsoft Defender for Office 365.\nEndpoint Detection & Response (EDR): Experience integrating and monitoring endpoint security events from solutions such as CrowdStrike and Microsoft Defender for Endpoint.\nNetwork Security Integration: Experience onboarding and troubleshooting security logs from firewalls and network security platforms, including Palo Alto, Fortinet, Juniper, and Cisco.\nWeb Application Firewall (WAF): Experience integrating and monitoring WAF logs from Cloudflare, Akamai, and Azure WAF.\nEmail Security: Experience integrating and analyzing email security telemetry from Proofpoint, Mimecast, and Microsoft Defender for Office 365.\nData Loss Prevention (DLP): Experience integrating and monitoring DLP events from Microsoft Purview, McAfee, and Symantec solutions.\nAWS Security Monitoring: Experience onboarding and analyzing AWS security logs and findings from AWS Security Hub, GuardDuty, Macie, AWS Config, and CloudTrail.\nExperience integration GCP logs into SIEM tools.\nSIEM Administration & Troubleshooting: Ability to independently troubleshoot ingestion failures, parsing issues, integration errors, agent health, data gaps, and performance problems, and to optimize data ingestion, retention, and storage.\nDetection Engineering & Operations: Experience developing and maintaining detection rules, alerting workflows, dashboards, and investigation queries to support SOC monitoring and incident response.\nIndependent Ownership: Ability to take end-to-end ownership of the Elastic Security platform, from initial deployment and data source onboarding through ongoing administration, maintenance, optimization, and operational support.\nExperience of security controls, such as network access controls; identity, authentication, and access management controls (IAAM); and intrusion detection and prevention controls.\nKnowledge of security standards (good practice) such as NIST, ISO27001, CIS (Center for Internet Security), OWASP and Cloud Controls Matrix (CCM) etc.\nKnowledge of scripting and coding with languages such as Terraform, python, javascript, golang, bash and/or powershell.\nKnowledge of DevOps practices such as CI/CD, Azure DevOps, CircleCI, GitHub Actions, Ansible and/or Jenkins.\nDesired Certifications:\nHolds one, or more, of the following certificates (or equivalent): -\nMicrosoft Certified: Security Operations Analyst Associate (SC-200)\nElastic Certified SIEM Analyst / Elastic Certified Engineer\nCompTIA Security+ / CySA+ or equivalent security certification is desirable.\no GIAC Security Operations Certified (GSOC)\no Certified Information Security Systems Professional (CISSP)\nSoft Skills\nSelf-motivated, proactive, and customer-focused professional.\nStrong analytical, troubleshooting, and problem-solving abilities.\nExcellent organizational and time-management skills.\nAbility to prioritize multiple incidents in a fast-paced operational environment.\nStrong verbal and written communication skills with technical and non-technical stakeholders.\nDemonstrated commitment to customer satisfaction and continuous improvement.\nAbility to work independently while collaborating effectively across teams.\nWillingness to work flexible schedules and support critical customer situations\n\nAbout Rackspace Technology\nRackspace Technology is the trusted operator of the full enterprise AI stack, from governed private cloud to AI inference and agents in production. From edge to core to cloud, we operate the infrastructure, data layer, and software integration to deliver business outcomes with the predictable cost, reliability, security, and compliance that regulated and mission-critical environments demand. We support customers in more than 120 countries with AI capabilities spanning private cloud, public cloud, applications, data and cyber resilience.\nMore on Rackspace Technology\nThough we’re all different, Rackers thrive through our connection to a central goal: to be a valued member of a winning team on an inspiring mission. We bring our whole selves to work every day. And we embrace the notion that unique perspectives fuel innovation and enable us to best serve our customers and communities around the globe. We welcome you to apply today and want you to know that we are committed to offering equal employment opportunity without regard to age, color, disability, gender reassignment or identity or expression, genetic information, marital or civil partner status, pregnancy or maternity status, military or veteran status, nationality, ethnic or national origin, race, religion or belief, sexual orientation, or any legally protected characteristic. If you have a disability or special need that requires accommodation, please let us know.","description_format":"text","description_chars":8061,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule"],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Space & Aerospace","Security Operations","Managed IT Services (MSP)","AI Consulting & Integration"],"lifecycle":[{"event":"open","at":"2026-10-28T07:56:46Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":29,"reasons":["conf:2","velocity","win:early"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/rackspace-technology-security-engineer-iii-in","json_url":"https://alion.io/job/rackspace-technology-security-engineer-iii-in.json","meta":{"generated_at":"2026-10-30T21:49:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12312,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":46166},"rest":"https://alion.io/mcp/rest/get_company?id=46166"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Frackspace-technology-security-engineer-iii-in"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Frackspace-technology-security-engineer-iii-in"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Frackspace-technology-security-engineer-iii-in"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/rackspace-technology-security-engineer-iii-in\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Frackspace-technology-security-engineer-iii-in"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3386607}},{"tool":"search_jobs","arguments":{"company":"rackspace.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3386607},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}