T&T | Cyber: D&R | Assistant Manager | SIEM | Delhi

T&T | Cyber: D&R | Assistant Manager | SIEM | Delhi
• Job requisition ID : 101791 
• Location: Delhi
• Entity: Deloitte Touche Tohmatsu India LLP 

The Team  

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity  

Your Work Profile 

The Detection Engineering - SIEM Platform Engineer is responsible for designing, deploying, maintaining, and optimizing SIEM platforms to support high‑fidelity security detection and response. This role partners closely with SOC, Threat Detection, and Incident Response teams to ensure scalable log ingestion, performant searches, and reliable detection use cases across multiple platforms such as IBM QRadar, Google SecOps (Chronicle), and other SIEM technologies.

• Design, develop, and maintain security detection use cases across SIEM platforms aligned to threat models and MITRE ATT&CK.
• Write and optimize detection logic using SIEM query languages (e.g., QRadar AQL, Google SecOps UDM Search).
• Continuously tune detections to reduce false positives, improve fidelity, and align alerting with SOC workflows.
• Own the full detection lifecycle including ideation, testing, validation, production deployment, and retirement.
• Partner with SOC and Incident Response teams to validate detections through incidents, threat hunts, and purple‑team activities.
• Perform detection gap analysis and prioritize new detections based on threat intelligence, risk and business impact.
• Ensure alerts include appropriate context, enrichment, severity, and investigation guidance.
• Maintain detection documentation, threat coverage mapping, and use‑case rationale.
• Support integrations between SIEM and security telemetry sources such as EDR, cloud platforms, IAM, network, AD, DNS, Proxy, FWs, SaaS tools etc.
• Validate log quality, parsing, normalization, and schema mappings to ensure detection logic works as intended.
• Assist in troubleshooting detection-related data and integration issues (missing logs, incorrect fields, latency).
• Provide detection-driven feedback on SIEM platform capabilities, limitations, and content improvements.
• Contribute to documentation related to data requirements, integrations, and detection dependencies.

  
Key Skills Required:

• Overall experience of 4-6 years in detection engineering, security analytics with hands-on responsibility for building and maintaining security detections.
• Any graduation Degree.
• Strong understanding of attack techniques, adversary behaviour, TTPs and the cyber kill chain, with the ability to translate threats into actionable detection logic.
• Proven experience developing, tuning, and operationalizing detections using SIEM platforms such as QRadar, Google SecOps (Chronicle), or similar technologies.
• Solid knowledge of security telemetry across endpoint, network, identity, cloud, and SaaS environments, including log formats and normalization concepts.
• Experience mapping detections to MITRE ATT&CK and performing detection gap analysis.
• Familiarity with detection enrichment, alert tuning, and false-positive reduction to support efficient SOC investigations.
• Exposure to threat intelligence integration within detections will be a value addition (use of IOCs, TTPs, contextual threat data).