{"id":1135508,"url":"https://alion.io/job/zeta-siem-secops-engineer-ii-2","title":"SIEM & SecOps Engineer II","company":{"id":95345,"name":"Zeta","domain":"zeta.tech","url":"https://alion.io/company/zeta-tech","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":79,"open_postings":7,"ghost_share":0,"stale_share":0.857,"repost_share":0,"time_to_fill_p50_days":32,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Hyderabad, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":14000,"max_usd":34000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":854},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AlienVault OTX","optional":false},{"name":"Amazon CloudWatch","optional":false},{"name":"Amazon EC2","optional":false},{"name":"Amazon EKS","optional":false},{"name":"Amazon S3","optional":false},{"name":"Anomaly Detection","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"ElasticSearch","optional":false},{"name":"ETL/ELT","optional":false},{"name":"Falco","optional":false},{"name":"Fluent Bit","optional":false},{"name":"Fluentd","optional":false},{"name":"GDPR","optional":false},{"name":"Git","optional":false},{"name":"Grafana","optional":false},{"name":"Helm","optional":false},{"name":"IAM","optional":false},{"name":"IBM QRadar","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kibana","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"Logstash","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MISP","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OpenSearch","optional":false},{"name":"osquery","optional":false},{"name":"PCI DSS","optional":false},{"name":"Prometheus","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"Splunk","optional":false},{"name":"Suricata","optional":false},{"name":"Velociraptor","optional":false},{"name":"VictoriaMetrics","optional":false},{"name":"Wazuh","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"Zeek","optional":false}],"status":"live","first_seen_at":"2026-07-24T14:43:33Z","employer_posted_date":"2026-07-24","last_verified_at":"2026-10-26T07:56:01Z","board_verified":true,"closed_at":null,"days_open":93,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":93},"description":"About us:\nBuild the future of banking.\n\nZeta is a next-generation banking technology company providing cloud-native, fully stackable processing and core banking platforms for issuers. With a focus on scalability, compliance, and innovation, Zeta empowers financial institutions to modernize their technology infrastructure and deliver secure, seamless digital banking experiences.\nOur impact runs at real-world scale. Today, over 25 million cards are live on Zeta-powered platforms across 7 countries, supported by a passionate team of 1,700+ Zetanauts across India, the US, EMEA, and Asia. Backed bySoftBank Vision Fund, Mastercard, and other reputed strategic investors, we reached a valuation of $2 billion in 2025.\nOur focus is on establishing product lines that focus on key outcomes by addressing real customer pain points, modernizing legacy systems, and strengthening core fundamentals. As a result, our systems and platforms support a wide range of banking and payments capabilities, including:\n1. Tachyon, our cloud-native banking stack built for population-scale systems\n2. Cipher, our unified authentication platform for secure, high-volume banking environments\n3. Digital Credit as a Service, enabling banks to launch credit lines on UPI\n4.Elena, our intelligent and conversational AI platform for banking\n5. Pixel, India’s first digital-native credit card, launched in partnership with HDFC Bank, for whom we also revamped their PayZapp mobile app: Winner of the Celent Model Bank Award for Payments Innovation 2024\n6. Sparrow, the leading card experience for non-prime cardholders in the US\n…and more across cards, payments, lending, and core banking.\nWe are an engineering-first organization that values ownership, bias for action, and long-term thinking. Together, we solve some of the hardest problems in banking tech. Our culture is built around trust, collaboration, and creating the conditions for you to drive impact proportionate to your potential. Reinforcing our commitment to creating an inclusive and supportive workplace, we have been consistently recognized as a Great Place to Work.\nIf you want to build cutting-edge banking tech that enables banks to serve millions reliably, securely, and at a population scale, Zeta is your playground.\nIf you would like to learn more about how we have grown and evolved over the years, watch our journey here. You can also explore our website and follow us on LinkedIn,Instagram,YouTube, andX.\nAbout the Role:\nAs a Security Operations Implementation Engineer, you will be playing a pivotal role in enabling Zeta in implementing and integrating SIEMs, detecting and responding to attacks at an early stage and make sure infrastructure and applications are secure. You will work with an amazing peer group that fuels this ambition.\nWe are looking for a highly motivated SIEM / SOC Engineerwith 4-6 years of experience in developing, enhancing, and maintaining enterprise-scale Security Operations and SIEM platforms based on the ELK Stack (Elasticsearch, Logstash, Kibana). The candidate will play a key role in advancing our next-generation security monitoring capabilities by enhancing existing SIEM modules, developing new detection use cases, integrating security technologies such as UEBA, SOAR, Threat Intelligence, and supporting the SOC team with effective detection and response capabilities.\nThe ideal candidate should possess strong hands-on experience in log parser development, security content engineering, ELK administration, AWS environments, microservices architectures, and open-source security technologies.\nResponsibilities:\nDesign, develop, and maintain high-fidelity detection rules, correlation rules, alerts, and security use cases for newly onboarded and existing log sources. Continuously tune detections to reduce false positives, improve detection fidelity, and expand detection coverage across the environment.\n\nDevelop security monitoring and detection content for AWS services, Kubernetes, microservices, Linux, macOS, databases, web applications, firewalls, and other enterprise technologies by leveraging the MITRE ATT&CK framework, threat intelligence, and adversary TTPs.\n\nOnboard new security and application log sources by developing Logstash pipelines, custom parsers, Grok patterns, ingest processors, and enrichment workflows. Analyze raw log formats, normalize events to a common schema, and enrich security telemetry to enable reliable detection and investigation.\n\nDesign and maintain operational dashboards, executive dashboards, SOC dashboards, and threat hunting visualizations using optimized OpenSearch Query DSL, aggregations, and visualizations to provide actionable security insights and platform observability.\n\nIntegrate Threat Intelligence Platforms (TIP), IOC feeds, and enrichment services with OpenSearch. Develop IOC correlation rules, automated enrichment workflows, and contextual detections to identify malicious activity across ingested telemetry.\n\nExpand the SIEM by implementing advanced capabilities such as UEBA, anomaly detection, OpenSearch Notebooks for investigation playbooks, SOAR workflows for automated response, and AI-driven automation to streamline Level 1 SOC operations.\n\nCollaborate with SOC analysts during alert investigations, threat hunting, and incident response by providing L2/L3 detection engineering support, validating detections, identifying detection gaps, and continuously improving existing security content.\n\nFollow Detection-as-Code practices by developing, testing, version-controlling, and deploying detection content through Git-based workflows and CI/CD pipelines, ensuring consistent, reliable, and scalable delivery of SIEM content.\n\nSkills:\nHands-on experience with any enterprise SIEM platforms such as Elastic/ELK, OpenSearch, Splunk, Microsoft Sentinel, IBM QRadar, ArcSight, Google Chronicle, Wazuh, ELK/EFK or similar solutions.\n\nExperience developing, maintaining, and tuning detection rules, correlation rules, alerts, dashboards, visualizations, and security use cases using SIEM query languages and detection frameworks such as OpenSearch/Elasticsearch Query DSL, Sigma, KQL, SPL, EQL, or equivalent.\n\nStrong experience onboarding log sources by developing custom parsers, Logstash pipelines, Fluentd/Fluent Bit configurations, Grok patterns, ETL pipelines, field mappings, log normalization, and data enrichment workflows.\n\n4-6 years of experience in Detection Engineering, SIEM Engineering, Security Operations, or SOC environments.\n\nGood understanding of SIEM architecture, event correlation, log management, detection engineering, the MITRE ATT&CK framework, Cyber Kill Chain, threat hunting methodologies, attacker TTPs, Threat Intelligence integration, and IOC-based detections.\n\nExperience developing detections and investigating security events across Linux, macOS, databases, web applications, firewalls, WAFs, enterprise infrastructure, and cloud environments.\n\nFamiliarity with open-source security technologies such as Wazuh, Suricata, Zeek (Bro), Velociraptor, HELK, EFK, Falco, osquery, or similar security monitoring solutions.\n\nStrong foundation in computer networking, operating systems, authentication and authorization concepts, web technologies, and common attack techniques.\n\nFamiliarity with YARA rules, malware detection concepts, and security automation is an added advantage.\n\nStrong analytical, troubleshooting, and investigative skills with the ability to identify detection gaps, validate detections, and continuously improve security monitoring content.\n\nHands-on experience with AWS environments and a good understanding of core AWS services such as IAM, CloudTrail, VPC, EC2, EKS, S3, CloudWatch, and cloud security monitoring concepts.\n\nFamiliarity with Kubernetes, Helm, containerized workloads, microservices architectures, and cloud-native security monitoring, Git, CI/CD Pipeline knowledge etc.\n\nExperience and Qualifications:\n4 to 6 years of overall experience as Security Operations engineer in medium to large-size product companies.\nBachelor of Technology (BE/B.Tech), M.Tech/ME in Computer Science or equivalent.\nMust have worked on the ELK/EFK implementation projects, and Logstash data parsing rules.\nThreat intelligence like OSINT, MISP, AlienVault, IDRBT etc.\nExpertise in Log monitoring tools like Splunk, ELK/EFK, SumLogic, Loggly etc.\nAssists in ensuring compliance with industry standards (for example, PCI DSS/3DS, GDPR, ISO 27001, SOC2 etc) by conducting assessments and implementing necessary controls, presenting to auditors.\nHands on experience in detection engineering, security investigations, incident response and forensics.\nExperience in threat hunting using threat intelligence to investigate potential risks and finding suspicious behaviour.\nCreate, modify, and tune the SIEM rules to adjust the specifications of alerts and incidents.\nDesigns, implements, and configures Kibana visualizations as required by the business.\nConfigures Logstash, FileBeats, VictoriaMetrics, Prometheus, Velociraptor, Grafana and possibly other ELK/EFK Stack components to collect and store the data necessary to meet business requirements efficiently.\nStrong data analysis skills; ability to independently write scripts/code to parse and analyse complex logs and data and optimize the SIEM system capabilities as well as the audit and logging features of the event log sources.\nUnderstanding and familiarity with existing TTP frameworks like MITRE ATT&CK, Cyber Kill Chain etc.","description_format":"text","description_chars":9496,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Cards & Card Issuing","Financial Software & Embedded Finance"],"lifecycle":[{"event":"open","at":"2026-09-23T07:41:09Z"}],"visa":[],"liveness":{"score":13,"band":"cold","label":"Long shot","p_open":1,"p_active":0.458,"p_room":0.28,"age_days":93,"expected_fill_days":32,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/zeta-siem-secops-engineer-ii-2","json_url":"https://alion.io/job/zeta-siem-secops-engineer-ii-2.json","meta":{"generated_at":"2026-10-26T11:26:22Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15429,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":95345},"rest":"https://alion.io/mcp/rest/get_company?id=95345"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fzeta-siem-secops-engineer-ii-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fzeta-siem-secops-engineer-ii-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fzeta-siem-secops-engineer-ii-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/zeta-siem-secops-engineer-ii-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fzeta-siem-secops-engineer-ii-2"}]}