Senior Staff Engineer SOC Platform

Job Title: Senior Staff Engineer SOC Platform

Location: Bengaluru

Experience Level: 10+ years

Role Summary

We are seeking a hands-on Senior SOC Engineer to build, operate, and scale the platforms powering our detection and response capabilities. This is an engineering-focused role—not an analyst or shift-monitoring role. You will own the end-to-end telemetry lifecycle, from log ingestion and pipeline routing to SIEM/SOAR infrastructure management. You will bridge the gap between network operations, security analysts, and platform engineering to ensure high-fidelity data availability at scale.

Key Responsibilities

• SIEM & SOAR Engineering: Architect and manage clustered, multi-site deployments of modern data lakehouse SIEM architectures utilizing Anvilogic as the detection layer alongside Snowflake and Elastic data platforms. Own the lifecycle, performance tuning, and automation playbook development to drive down MTTR.
• Telemetry Pipeline (Cribl): Operate Cribl Stream/Edge to parse, filter, mask, and enrich data streams. Implement intelligent routing to optimize ingest costs and enable data replay for investigations.
• Log Collection & Onboarding: Architect high-volume syslog tiers (rsyslog/syslog-ng). Own the end-to-end onboarding of diverse telecom, network, cloud, and enterprise sources, ensuring alignment with standardized security models (OCSF/ECS) and mapping detections within Anvilogic to the MITRE ATT&CK framework.
• Platform & Infrastructure Ops: Manage the full stack across on-premises and GCP environments. Use IaC (Terraform) and configuration management (Ansible) to automate platform health, capacity planning, and disaster recovery for your structured Snowflake warehouses and ClickHouse clusters.
• Systems Engineering: Administer enterprise Linux (RHEL/Ubuntu) at scale. Develop custom operational tooling and health-check scripts using Python and Bash. Install, configure, and maintain Linux servers and operating systems across on-premises and cloud environments. Monitor system performance, disk space, memory usage, and network connectivity; troubleshoot and resolve issues. Perform regular backups, disaster recovery planning, and ensure business continuity.
• Kubernetes: Deploy and manage containerized applications using Docker and Kubernetes, ensuring high availability and fault tolerance. Implement CI/CD pipelines with Kubernetes integration for automated testing, building, and deployment workflows. Configure service discovery, load balancing, ingress controllers, and persistent storage solutions.

Required Qualifications

• Experience: 10+ years in security/SOC engineering, log management, or infrastructure engineering.
• SIEM/SOAR Expertise: Hands-on production experience administering Anvilogic, Snowflake, and ClickHouse security lakehouse architectures (clustering, data tiering, database optimization) and SOAR platforms (playbook development/connectors).
• Pipeline Proficiency: Expert-level experience with log pipeline tooling (Cribl Stream/Edge preferred; Logstash/Vector/Kafka considered).
• Infrastructure Skills: Strong Linux administration, scripting (Python/Bash), and syslog fundamentals (TLS, load balancing, high-volume tuning).
• Data Onboarding: Proven ability to write complex regex-based parsers, field extractions, and normalization logic.
• Cloud & Networking: Working knowledge of GCP services (Logging, IAM, GKE, Networking) and solid grasp of networking fundamentals (TCP/UDP, DNS, routing, packet capture).
• Communication: Excellent written communication and disciplined documentation habits.

Preferred Qualifications

• Domain Expertise: Experience in a telecom or service provider environment (Mobile Core, 5G, IMS/VoLTE, SS7/Diameter, OSS/BSS).
• DevOps/Automation: Experience with Kubernetes/Helm, Terraform, and Ansible in hybrid environments.
• Detection Engineering: Exposure to Snowflake SQL, ClickHouse SQL, Anvilogic low-code/no-code builders, KQL, Sigma rules, and data lake/object storage tiering architectures.
• Certifications: Splunk Architect, Elastic Certified Engineer, Cribl Certified Admin, RHCE/RHCSA, Google Professional Cloud Security Engineer, AWS Professional certificate.