Lead Security Engineer – Platform

Expleo Group

. Act as subject matter expert in endpoint protection and XDR, application allowlisting, email security gateways, and web-edge platforms including WAF, DDoS and DNS .

Posted 10/13/2026full-timeChennai • IndiaSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in endpoint protection, XDR, and application allowlisting, with a strong focus on secure configuration baselines and incident response. Proficient in leading security engineering teams and providing advisory support during major incidents.

Highest-signal resume keywords

Endpoint Protection ExpertiseXDR Platform KnowledgeApplication Allowlisting ExperienceSIEM Log Onboarding UnderstandingIncident Response Lifecycle Knowledge

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Endpoint ProtectionXDRApplication AllowlistingEmail Security GatewaysWeb Application FirewallDDoS ProtectionDNS ProtectionScriptingData AnalysisSecure Configuration Baselines

Soft Skills

LeadershipAdvisory SupportKnowledge SharingQuality Review

Tools & Technologies

Palo Alto CortexMicrosoft DefenderCrowdStrikeIBM QRadarSplunkCarbon Black App ControlCisco Secure EmailProofpointF5Cloudflare

Certifications & Qualifications

GIAC GCIHGIAC GCIACompTIA CySA+ITIL 4 Foundation

Industry Keywords

CybersecurityCNIDigital ForensicsForensic-ReadinessOT Security

Tech Stack

Tools & technologies

Cyber SecurityDNSPythonSplunk

About the role

Key responsibilities & impact

Act as subject matter expert in endpoint protection and XDR, application allowlisting, email security gateways, and web-edge platforms including WAF, DDoS and DNS
Define and maintain secure configuration baselines and hardening standards aligned with vendor best practices and client policy
Review platform configurations using exports released through the UK service boundary and recommend improvements
Design platform changes and prepare implementation, test and back-out plans for UK-based personnel
Assess application-control exception and policy-exclusion requests and provide risk-based recommendations
Analyse platform reporting and produce monthly reports and recommendations
Assess security-log-feed coverage in the retained SIEM and recommend corrective actions and detection-use-case improvements
Track vendor support lifecycles, identify end-of-support risks and produce upgrade plans
Provide platform expertise and forensic-readiness input through runbooks, evidence sources and playbooks
Provide advisory support to incident management, including during major incidents
Contribute platform content to monthly service reports and maintain platform diagrams and documentation
Lead, allocate and quality-review the work of Network and Identity Security Engineers
Support the growth of Expleo's Cybersecurity Practice through knowledge sharing, technical contribution and client-facing delivery excellence
Work outside the client's operational environment without access to client operational systems or data or authority to make live changes

Requirements

What you’ll need

Degree in computer science, cybersecurity or a related discipline, or equivalent professional experience
Vendor certification in at least one enterprise endpoint/XDR or SIEM platform (e.g. Palo Alto Cortex, Microsoft SC-200, CrowdStrike, IBM QRadar, Splunk)
Strong knowledge of EDR/XDR and anti-malware platforms (e.g. Palo Alto Cortex XDR, Microsoft Defender, CrowdStrike, Trellix)
Experience with application allowlisting and device control (e.g. Carbon Black App Control, Airlock Digital, WDAC)
Experience with email security gateways (e.g. Cisco Secure Email, Proofpoint, Mimecast)
Experience with web application firewall, DDoS and DNS protection services (e.g. F5, Cloudflare, Akamai)
Understanding of SIEM log onboarding and detection use cases (e.g. QRadar, Splunk, Sentinel)
Ability to produce secure configuration baselines, design documentation and change packages
Knowledge of incident response lifecycle (NIST SP 800-61) and ITIL change and incident management
Scripting and data analysis skills using PowerShell, Python, KQL, AQL or SPL
10–12 years in security engineering or operations, including 3+ years in a lead role across endpoint, gateway and logging platforms
Experience leading and quality-reviewing the work of other engineers
Experience supporting managed security services in regulated or CNI environments
GIAC GCIH/GCIA, CompTIA CySA+ or ITIL 4 Foundation would be advantageous
Digital forensics and forensic-readiness experience, energy/utilities or CNI sector experience, and awareness of OT security constraints are desired
Work within Expleo's India-based offshore consultancy team

Benefits

Comp & perks

Hybrid workplace
Permanent employment
Knowledge sharing and technical contribution opportunities
Client-facing delivery experience
Opportunity to support the growth of Expleo's Cybersecurity Practice