Crowdstrike NG SIEM and Onum Engineer
Posted Updated
Description
Job Title: Crowdstrike NG SIEM and Onum Engineer
Requisition ID: DLTJP00064073
Location: All 7 USI Locations (Hyderabad, Bengaluru, Gurugram, Mumbai, Pune, Chennai, Kolkata)
Work Model: Hybrid
Shift Timings: 11:00 AM - 8:00 PM (Rotational Coverage: Japan, US, India)
Notice Period: Immediate Joiners (Onboarding within 2 weeks)
Requisition ID: DLTJP00064073
Location: All 7 USI Locations (Hyderabad, Bengaluru, Gurugram, Mumbai, Pune, Chennai, Kolkata)
Work Model: Hybrid
Shift Timings: 11:00 AM - 8:00 PM (Rotational Coverage: Japan, US, India)
Notice Period: Immediate Joiners (Onboarding within 2 weeks)
Key Responsibilities:
- Administer, optimize, and support CrowdStrike Falcon Next-Gen SIEM & Falcon Onum platform architectures.
- Design, build, and maintain Falcon Onum data pipelines to ingest, parse, filter, enrich, transform, and route telemetry from third-party sources to Falcon Next-Gen SIEM.
- Onboard diverse log sources (servers, endpoints, Active Directory, firewalls, VPNs, cloud/SaaS, applications, and databases) using collectors, syslog, and API-based connectors.
- Develop, test, and maintain custom parsers and regex-based field normalization schemas in CrowdStrike NGSIEM.
- Write, tune, and manage threat detection rules, correlation queries, and alert workflows using CrowdStrike Query Language (CQL).
- Drive threat detection coverage and gap analysis mapped directly against the MITRE ATT&CK framework.
- Optimize data ingestion, filtering, and data retention models to manage enterprise licensing and storage costs via Falcon Onum or comparable pipeline tools.
- Automate detection workflows and playbooks using CrowdStrike Falcon Fusion and external ticketing/threat intel tools.
- Administer, optimize, and support CrowdStrike Falcon Next-Gen SIEM & Falcon Onum platform architectures.
- Design, build, and maintain Falcon Onum data pipelines to ingest, parse, filter, enrich, transform, and route telemetry from third-party sources to Falcon Next-Gen SIEM.
- Onboard diverse log sources (servers, endpoints, Active Directory, firewalls, VPNs, cloud/SaaS, applications, and databases) using collectors, syslog, and API-based connectors.
- Develop, test, and maintain custom parsers and regex-based field normalization schemas in CrowdStrike NGSIEM.
- Write, tune, and manage threat detection rules, correlation queries, and alert workflows using CrowdStrike Query Language (CQL).
- Drive threat detection coverage and gap analysis mapped directly against the MITRE ATT&CK framework.
- Optimize data ingestion, filtering, and data retention models to manage enterprise licensing and storage costs via Falcon Onum or comparable pipeline tools.
- Automate detection workflows and playbooks using CrowdStrike Falcon Fusion and external ticketing/threat intel tools.
Required Qualifications:
- Overall 3-8 years of experience in SIEM Engineering, administration, or security detection engineering.
- Proven hands-on delivery with CrowdStrike Falcon Next-Gen SIEM / LogScale (Humio).
- Direct experience with telemetry pipeline engineering, filtering, and routing using Falcon Onum or comparable pipeline engines (e.g., Cribl Stream).
- Proficient in writing detection logic, search queries, and custom parsers using CrowdStrike Query Language (CQL) and Regular Expressions.
- Solid understanding of network protocols, cloud audit logs, Active Directory, and MITRE ATT&CK adversary tactics.
- Overall 3-8 years of experience in SIEM Engineering, administration, or security detection engineering.
- Proven hands-on delivery with CrowdStrike Falcon Next-Gen SIEM / LogScale (Humio).
- Direct experience with telemetry pipeline engineering, filtering, and routing using Falcon Onum or comparable pipeline engines (e.g., Cribl Stream).
- Proficient in writing detection logic, search queries, and custom parsers using CrowdStrike Query Language (CQL) and Regular Expressions.
- Solid understanding of network protocols, cloud audit logs, Active Directory, and MITRE ATT&CK adversary tactics.
This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.
