Join VOIS as a senior SIEM Content Development Specialist in Pune, India (with locations also noted in Bangalore). You will lead the creation and optimization of threat detection scenarios, SIEM rules, and security content using platforms like ArcSight, Splunk, and ELK/Elastic.

Job description

Who we are

VOIS (Vodafone Intelligent Solutions) is a strategic arm of Vodafone Group Plc, creating value for customers by delivering intelligent solutions through Talent, Technology & Transformation.
As the largest shared services organisation in the global telco industry with 30,000 FTE, our portfolio of next-generation solutions and services are designed in partnership with customers across Vodafone Group, local markets, and partner markets to simplify and drive growth. With our strategic partner Accenture, we work alongside our Vodafone customers, other Telco and tech companies to drive transformation, meet the challenges of our industry and ensure we stay relevant and resilient. This partnership is a unique, industry-first model which brings together the best of in-house and 3rd party capability.
We work with customers across 28 countries from 10 VOIS locations: Albania, Egypt, Hungary, India, Romania, Spain, Turkey, UK, Germany, Ireland, and with a network of teams in Czech Republic, Italy, Greece, and Portugal.
#VOIS #BeUnrivalled #CreateTheFuture

About this Role

We are seeking a SIEM Content Development Specialist to join the Cyber Defence – Cyber Security Operations function in Pune and contribute to the detection capability of the Cyber Security Operations Centre (CSOC).
This is a senior cyber security role requiring 10+ years of relevant experience across Security Operations, SIEM Content Development, Security Engineering, Threat Hunting and Threat Intelligence. You will translate business and project requirements, the evolving threat landscape, MITRE ATT&CK TTPs and cyber risks into effective detection scenarios, SIEM rules and security content.
The role combines hands-on SIEM content engineering, threat detection, EDR/XDR content development, threat response and software engineering. You will work with security technologies including ArcSight, Google SecOps, SOAR, Splunk, Microsoft Sentinel and ELK/Elastic, as well as cloud and security telemetry across AWS, GCP and Microsoft technologies.
You will operate with minimal supervision, make independent technical decisions and build effective relationships across the Vodafone security community.

What you’ll do

Develop, refine and optimise security content and detection rules across existing and new SIEM, EDR and XDR technologies.
Translate threat intelligence, adversary behaviour, attack vectors and MITRE ATT&CK TTPs into indicator-based and behavioural detections that identify or prevent malicious activity.
Create threat scenarios and SIEM use cases, with particular emphasis on ArcSight and ELK/Elastic, while supporting other SIEM technologies.
Analyse security events, threats, adversaries and attack tools to identify opportunities for new or improved detection coverage.
Tune SIEM rules and correlation logic to improve CSOC detection effectiveness and operational efficiency.
Develop and integrate threat-response workflows and playbooks supporting Cyber Defence operations.
Collaborate with log-source owners and customers to understand telemetry, clarify detection requirements and translate them into actionable security content.
Contribute to post-incident analysis and residual-risk assessments, converting operational and technical lessons learnt into actionable detection improvements.
Apply SDLC and Agile methodologies to security content engineering, including sprint delivery, backlog refinement and cross-functional collaboration.
Develop security content and supporting automation using languages and technologies such as Python, KQL, YARA-L, SQL, PowerShell and Regex.
Contribute to cyber security reports and advisories for key stakeholders.
Maintain relevant documentation, including playbooks, workflows, detection logic and SIEM Content Development Team documentation.

Who you are

10+ years of relevant experience across Security Operations (SOC), SIEM Content Development, Security Engineering, Threat Hunting and/or Threat Intelligence.
Extensive hands-on experience in security event analysis and SIEM content development, including creation, refinement and optimisation of security detections.
Practical experience creating threat scenarios, use cases and detection rules in SIEM platforms, preferably ArcSight and ELK/Elastic.
Working knowledge of security technologies including ArcSight, Google SecOps, SOAR, Splunk and Microsoft Sentinel, alongside EDR/XDR technologies.
Experience with cloud technologies and telemetry across AWS, GCP and Microsoft environments, including EDR, Log Analytics and Azure, with knowledge of Oracle environments.
Software engineering and development experience, including an understanding of data structures and algorithms, with expertise in one or more languages such as Python, KQL, YARA-L, SQL or PowerShell.
Good working knowledge of regular expressions (Regex) for security detection and log-analysis requirements.
In-depth understanding of security frameworks and adversary methodologies, including MITRE ATT&CK, Cyber Kill Chain and APT campaign strategies.
Deep knowledge of cyber threats, vulnerabilities, cyber risk analysis and relevant security-reporting frameworks.
Strong knowledge of networking protocols and addressing, including TCP/IP, CIDR blocks, subnets and network communications.
Knowledge of security technologies including firewalls, intrusion detection systems, anti-malware/AV solutions, anti-spam systems, event-correlation technologies and log-analysis platforms.
Practical experience with SDLC and Agile frameworks, including Scrum, Kanban or SAFe.
Strong analytical, communication and stakeholder-management capabilities, with the ability to take ownership and make independent technical decisions.
The ability to work effectively within cross-functional teams, manage sprint activities and contribute to backlog refinement.
A degree in Information Technology, Engineering or a similar discipline.
Prior or current information security or advanced networking certifications, including but not limited to CISSP, GCIH or GCIA.
Experience leading teams or driving security projects is an advantage.
Previous experience within the telecommunications industry is advantageous.
Experience identifying and analysing threats that may evade custom and out-of-the-box detection rules is highly beneficial.
Knowledge of security tool architecture and design, including modern threats and APT technologies, is beneficial.

Not a perfect fit?

Concerned you may not meet every requirement? Vodafone is committed to creating an inclusive workplace where everyone can thrive. If you are excited about this role but your experience does not align exactly with every aspect of the job description, you are encouraged to apply. You may be the right candidate for this or another opportunity, and the recruitment team will support you in exploring where your skills fit best.

What's in it for you

The opportunity to contribute directly to Vodafone's Cyber Defence capability and help protect customers against global cyber risk.
Exposure to enterprise-scale security capabilities spanning SIEM, SOAR, EDR/XDR, threat intelligence and cloud security telemetry.
Opportunities to develop complex detection scenarios addressing modern attack techniques, adversary behaviour and APT activity.
Collaboration across Vodafone's security community, including CSOC teams, log-source owners, customers and technology stakeholders.
The opportunity to influence detection quality and operational effectiveness through content engineering, rule optimisation, playbook development and continuous improvement.

What skills you will learn

Advanced SIEM content and detection engineering, including indicator-based and behavioural detection approaches.
Translating MITRE ATT&CK TTPs, threat intelligence and adversary behaviour into actionable detections.
Detection engineering across technologies such as ArcSight, Google SecOps, Splunk, Microsoft Sentinel and ELK/Elastic.
Security content engineering using Python, KQL, YARA-L, SQL, PowerShell and Regex.
Developing and tuning EDR/XDR security content and threat-response workflows.
Detection using cloud and security telemetry from AWS, GCP and Microsoft environments.
Threat hunting, residual-risk assessment, post-incident improvement and security advisory activities.
Applying SDLC, Scrum, Kanban and SAFe practices within security-content engineering.

VOIS Equal Opportunity Employer Commitment

Vodafone recognises and celebrates the value of diversity in building a workforce that reflects the customers and communities it serves. No form of discrimination is tolerated. This includes, but is not limited to, discrimination based on race, colour, age, veteran status, gender identity, gender expression, sexual orientation, pregnancy, maternity or parental status, ethnicity, disability, religion or belief, political affiliation, trade union membership, nationality, citizenship, indigenous status, medical condition, HIV status, neurodiversity, social origin, cultural background, marital or civil partnership status, or socio-economic background.

Join Us

At Vodafone, we’re working hard to build a better future. A more connected, inclusive and sustainable world. As a dynamic global community, it's our human spirit, together with technology, that empowers us to achieve this.
We challenge and innovate in order to connect people, businesses, and communities across the world. Delighting our customers and earning their loyalty drive us, and we experiment, learn fast and get it done, together.
With us, you can truly be yourself and belong, share inspiration, embrace new opportunities, thrive, and make a real difference.

Alert

Apply for Vodafone jobs only through the official Vodafone Careers website to avoid job scams and fraud.
#JDEnhancedByTARA

LinkedIn: https://www.linkedin.com/company/vois/
Facebook: https://www.facebook.com/voisglobal
Instagram: https://www.instagram.com/voisglobal/

Similar jobs