Principal Information Security Engineer

First American (India)

. Design, implement, and maintain Splunk infrastructure, including Splunk and Cribl upgrades .

Posted 11/11/2026full-timeRemote • IndiaLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in SIEM and data management platforms, particularly with Splunk and Cribl, focusing on deployment, configuration, and optimization. Proficient in cloud infrastructure deployment across Azure, AWS, and GCP, with strong analytical skills for security operations and compliance.

Highest-signal resume keywords

Splunk Infrastructure ManagementCribl Onboarding Using REST APISIEM Detection EngineeringCloud Infrastructure DeploymentData Engineering Practices

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SIEM PlatformsData ManagementPythonPowerShellBashAWS LambdaAzure FunctionsData WarehousingReal-Time Data ProcessingData Normalization

Soft Skills

Analytical SkillsCollaborationProject ManagementVerbal CommunicationWritten Communication

Tools & Technologies

SplunkCriblAzureAWSGCPMicrosoft WordMicrosoft ExcelMicrosoft PowerPointMicrosoft VisioCursor

Certifications & Qualifications

Splunk Certified Power User/AdminCribl Certified AdminSecurity+CEHOSCPCISSP

Industry Keywords

MITRE ATT&CKCOBITNIST 800-53ISO27001SSAE16SOC1SOC2Vulnerability RemediationChange ManagementIT Service Management

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityFirewallsGoogle Cloud PlatformITSMPythonSplunk

About the role

Key responsibilities & impact

Design, implement, and maintain Splunk infrastructure, including Splunk and Cribl upgrades
Support Cribl onboarding using REST API, S3 collectors, HEC, and related methods
Implement and support multi-cloud infrastructure deployments
Enable efficient data routing, parsing, and filtering
Apply data warehousing, real-time data processing, and data normalization concepts
Collect, analyze, and correlate logs using SIEM and data management platforms
Lead SIEM detection engineering by developing and fine-tuning correlation rules, alerts, and dashboards
Expand data engineering practices using advanced analytics and machine learning for proactive threat detection
Participate in the purple team lifecycle with offensive and defensive security teams
Automate SIEM and data management operations
Collaborate with cross-functional teams to mitigate security risks and vulnerabilities
Audit security configurations, policies, and procedures for compliance
Monitor current security trends, tools, and best practices
Provide guidance and support to security engineers
Perform operational on-call support and ad hoc duties outside normal work hours as required

Requirements

What you’ll need

Extensive experience with SIEM and data management platforms, particularly Splunk and Cribl, including deployment, configuration, optimization, administration, and functional use
Experience with Cribl onboarding using REST API, S3 collectors, HEC, and related tooling
Strong understanding of network protocols, firewalls, intrusion detection systems, endpoint security solutions, and Azure, AWS, and GCP
Demonstrated ability to deploy, configure, and secure infrastructure in Azure, AWS, and GCP
Proficiency in Python, PowerShell, or Bash; AWS Lambda and Azure Functions experience is a plus
Strong understanding of MITRE ATT&CK
Hands-on experience developing, tuning, and deploying SIEM security detections
Excellent analytical skills for complex engineering issues
Knowledge of COBIT, NIST 800-53, ISO27001, SSAE16, SOC1, and SOC2
Proficiency in Microsoft Word, Excel, PowerPoint, and Visio
Strong verbal, written, and presentation skills
Ability to manage multiple high-priority projects and tasks
Ability to work collaboratively in a team-oriented environment
Generally requires a bachelor’s degree in computer science, Information Technology, Cybersecurity, or related field, or equivalent work experience
Minimum of 10 years’ information security experience, focused on SIEM, data management, and security operations
Relevant certifications such as Splunk Certified Power User/Admin, Cribl Certified Admin, Security+, CEH, OSCP, or CISSP
Experience using Cursor, ChatGPT, or similar AI platforms is good to have
Familiarity with Azure DevOps is good to have
Familiarity with APIs, syslog, forwarders, cloud integrations, and security or observability data sources
Experience with IT service management, change management, and vulnerability remediation workflows
Familiarity with cloud platforms, containers, or infrastructure-as-code

Benefits

Comp & perks

Equal Opportunity Employer
Inclusive workplace committed to respecting, supporting, and inspiring all individuals
Diversity and inclusion practices
Potential operational on-call support based on business needs