Security Data & SIEM Engineer

Security Data & SIEM Engineer

Job Title: Security Data & SIEM Engineer (Cribl & SIEM)

Location: Bangalore/Pune, India

What you will do:

As part of Johnson Controls’ Global Zero Trust & Security Analytics team, the Security Data & SIEM Engineer will be responsible for the day-to-day operation, management, and optimization of our enterprise security logging pipeline and SIEM platform. This role is heavily focused on Cribl Stream log stream processing, log parsing, and CrowdStrike NextGen SIEM data onboarding, with secondary focus on Global event routing and Security Data Fabric integration across enterprise security platforms.

How you will do it:

Primary Focus: Cribl Log Stream Engineering & SIEM Data Operations

·       Daily Operations & Telemetry Health: Serve as the operational SME for the Cribl Stream pipeline and CrowdStrike NextGen SIEM environment. Conduct daily health checks, monitor log flow metrics, and resolve ingestion disruptions or collector errors.

·       Log Ingestion, Parsing & Schema Normalization: Onboard new enterprise log sources (Firewalls, EDR, Web Proxies, Active Directory, Cloud logs). Create and maintain Cribl routes, pipelines, event breakers, and custom parsers to ensure standardized schema mapping.

·       Log Cost Optimization & FinOps: Implement intelligent filtering, deduplication, and routing rules in Cribl Stream to strip unnecessary log noise, optimizing cloud storage (Azure Event Hubs) and SIEM license utilization.

·       Troubleshooting & Recovery: Investigate API token expirations, network timeouts, and log schema drift. Utilize monitoring tools (such as Cribl Vision) for proactive drop-off detection and rapid incident recovery.

Secondary Focus: Security Data Fabric & Infrastructure Integration

·       Security Data Fabric Automation: Assist in connecting security telemetry between platforms (Imperva WAF, Zscaler, Firewalls, and SIEM) to automate the sharing of malicious IP/URL indicators and threat intelligence.

·       Cloud Log Architecture Optimization: Collaborate with cloud architects to streamline Azure log collection (e.g., regional Event Hub deployments), reducing redundant workspace storage costs.

·       Cross-Team Collaboration: Partner with SOC, Cloud Engineering, Network Security, and GRC teams to ensure high data quality, clear log ownership, and audit-compliant log retention.

What we look for:

Required Skills (Must-Haves):

·       Hands-on operational experience with Cribl Stream (Routes, Pipelines, Functions, Event Breakers, Worker Groups) or equivalent log pipeline technologies (Logstash, Vector, Fluentd).

·       Experience working with enterprise SIEM or Log Analytics platforms (CrowdStrike NextGen SIEM / Humio, Azure Log Analytics, or Splunk).

·       Solid understanding of common log sources and formats (Syslog, JSON, CEF/LEEF, Windows Event Logs, Cloud Audit Logs, NetFlow).

·       Practical experience with cloud logging infrastructure (Azure Event Hubs, Storage Accounts, or AWS S3/CloudWatch) and REST API data ingestion.

·       Basic scripting and automation skills in Python, PowerShell, or Bash for API calls and log parsing.

·       Strong troubleshooting mindset and ITIL operational experience (Incident, Change, and Problem Management via ServiceNow/Jira).

Desirable Skills (Nice-to-Haves):

·       Cribl Stream Certification (Cribl Certified Admin or User) or CrowdStrike Falcon LogScale / NextGen SIEM certifications.

·       Understanding of Log Common Information Models (CIM) and schema mapping standards.

·       Exposure to Security Data Fabric, Threat Intelligence feeds, or automated SOAR workflows.

·       Familiarity with ServiceNow CMDB, Jira tracking, and building basic operational dashboards.

Johnson Controls International plc. is an equal employment opportunity and affirmative action employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, protected veteran status, genetic information, status as a qualified individual with a disability, or any other characteristic protected by law. For more information, please view EEO is the Law. If you are an individual with a disability and you require an accommodation during the application process, please visit www.johnsoncontrols.com/careers.