Expleo - Lead Security Engineer - SIEM/Palo Alto Firewall in Chennai, भारत

As Lead Security Engineer | Platform, you will be the subject matter expert for the client's endpoint, application control, email, and web-edge security platforms and will lead the Network and Identity Security https://jobeax.com/link/3ZFmU3QxZvHi6sBB is a design, review and advisory https://jobeax.com/link/VN5Epe5Pl3XYpjdR will work within Expleo's offshore consultancy team, outside the client's operational https://jobeax.com/link/gD6KwWWDdaH9sykX will not have access to the client's operational systems or data and will not make live https://jobeax.com/link/YJ2ZfjBmQCfAnSoP changes are implemented by UK-based, security-cleared personnel; your work provides the designs, analysis, recommendations and assurance that those changes depend https://jobeax.com/link/MEIT1PrbjJd34Sy4 will work from information released to the team through Expleo's controlled UK service boundary.Responsibilities:- Act as a subject matter expert in endpoint protection and XDR, application allowlisting, email security gateways, and web-edge platforms (WAF, DDoS, and DNS).- Define and maintain secure configuration baselines and hardening standards aligned to vendor best practices and client policy.- Review platform configurations, using exports released through the UK service boundary, and recommend improvements.- Design platform changes and prepare complete change packages, including implementation, test and back-out plans, for implementation by UK-based personnel.- Assess application control exception and policy exclusion requests and provide risk-based recommendations for governance approval.- Analyse platform reporting (endpoint coverage and drift, malware trends, email threat trends, application control activity) and produce monthly reports and recommendations.- Assess the coverage of security log feeds in the client's retained SIEM against the logging design, and recommend corrective actions and improvements to detection use cases.- Track vendor support lifecycles, identify end-of-support risk and produce upgrade plans.- Provide platform expertise and forensic-readiness input (runbooks, evidence sources, playbooks) to support the UK SOC and incident response partner.- Provide advisory support to incident management when requested, including during major incidents.- Contribute platform content to monthly service reports and maintain platform diagrams and documentation.- Lead, allocate and quality-review the work of the Network and Identity Security Engineers.- Support the growth of Expleo's Cybersecurity Practice through knowledge sharing, technical contribution and client-facing delivery excellence.Qualifications:- Degree in computer science, cybersecurity or a related discipline, or equivalent professional experience.- Vendor certification in at least one enterprise endpoint/XDR or SIEM platform (e.g. Palo Alto Cortex, Microsoft SC-200, CrowdStrike, IBM QRadar, Splunk).- GIAC GCIH/GCIA, CompTIA CySA+ or ITIL 4 Foundation would be https://jobeax.com/link/oXYJdA8thxmtawBn Skills:- Strong knowledge of EDR/XDR and anti-malware platforms (e.g. Palo Alto Cortex XDR, Microsoft Defender, CrowdStrike, Trellix).- Application allowlisting and device control (e.g. Carbon Black App Control, Airlock Digital, WDAC).- Email security gateways (e.g. Cisco Secure Email, Proofpoint, Mimecast).- Web application firewall, DDoS and DNS protection services (e.g. F5, Cloudflare, Akamai).- Understanding of SIEM log onboarding and detection use cases (e.g. QRadar, Splunk, Sentinel).- Producing secure configuration baselines, design documentation and change packages.- Incident response lifecycle (NIST SP 800-61) and ITIL change and incident management.- Scripting and data analysis (PowerShell, Python, KQL, AQL or SPL) for https://jobeax.com/link/MAQhAT4yVkl7Py5W Skills:- Digital forensics and forensic-readiness experience (e.g. EnCase, FTK, Magnet AXIOM) and chain-of-custody practice.- Energy, utilities or other CNI sector experience.- Awareness of OT security constraints.Experience:- 10 - 12 years in security engineering or operations, including 3+ years in a lead role across endpoint, gateway and logging platforms.- Experience leading and quality-reviewing the work of other engineers.- Experience supporting managed security services in regulated or CNI environments. (ref:hirist.tech)