Security Data & SIEM Engineer
Johnson Controls — Bengaluru, Karnataka; Pune, Maharashtra
₹4–8 LPA (HireSetu estimate) · Entry level · Freshers eligible · Full-time · Apply by 2 Dec 2026
HireSetu listing reference 3b64be · employer requisition WD30283070 — confirm requirements below, then apply on the employer site.
Quick answer: A security logging pipeline job for someone who has already run Cribl Stream in production. Most of the week goes on parsing, routing and trimming logs before they reach CrowdStrike's SIEM, with cost control treated as part of the engineering.
From Johnson Controls' job posting
Job Title: Security Data & SIEM Engineer (Cribl & SIEM)
Location: Bangalore/Pune, India
What you will do
As part of Johnson Controls’ Global Zero Trust & Security Analytics team, the Security Data & SIEM Engineer will be responsible for the day-to-day operation, management, and optimization of our enterprise security logging pipeline and SIEM platform. This role is heavily focused on Cribl Stream log stream processing, log parsing, and CrowdStrike NextGen SIEM data onboarding, with secondary focus on Global event routing and Security Data Fabric integration across enterprise security platforms.
How you will do it
Primary Focus: Cribl Log Stream Engineering & SIEM Data Operations
- Daily Operations & Telemetry Health: Serve as the operational SME for the Cribl Stream pipeline and CrowdStrike NextGen SIEM environment. Conduct daily health checks, monitor log flow metrics, and resolve ingestion disruptions or collector errors.
- Log Ingestion, Parsing & Schema Normalization: Onboard new enterprise log sources (Firewalls, EDR, Web Proxies, Active Directory, Cloud logs). Create and maintain Cribl routes, pipelines, event breakers, and custom parsers to ensure standardized schema mapping.
- Log Cost Optimization & FinOps: Implement intelligent filtering, deduplication, and routing rules in Cribl Stream to strip unnecessary log noise, optimizing cloud storage (Azure Event Hubs) and SIEM license utilization.
- Troubleshooting & Recovery: Investigate API token expirations, network timeouts, and log schema drift. Utilize monitoring tools (such as Cribl Vision) for proactive drop-off detection and rapid incident recovery.
Secondary Focus: Security Data Fabric & Infrastructure Integration
- Security Data Fabric Automation: Assist in connecting security telemetry between platforms (Imperva WAF, Zscaler, Firewalls, and SIEM) to automate the sharing of malicious IP/URL indicators and threat intelligence.
- Cloud Log Architecture Optimization: Collaborate with cloud architects to streamline Azure log collection (e.g., regional Event Hub deployments), reducing redundant workspace storage costs.
- Cross-Team Collaboration: Partner with SOC, Cloud Engineering, Network Security, and GRC teams to ensure high data quality, clear log ownership, and audit-compliant log retention.
Required Skills (Must-Haves)
- Hands-on operational experience with Cribl Stream (Routes, Pipelines, Functions, Event Breakers, Worker Groups) or equivalent log pipeline technologies (Logstash, Vector, Fluentd).
- Experience working with enterprise SIEM or Log Analytics platforms (CrowdStrike NextGen SIEM / Humio, Azure Log Analytics, or Splunk).
- Solid understanding of common log sources and formats (Syslog, JSON, CEF/LEEF, Windows Event Logs, Cloud Audit Logs, NetFlow).
- Practical experience with cloud logging infrastructure (Azure Event Hubs, Storage Accounts, or AWS S3/CloudWatch) and REST API data ingestion.
- Basic scripting and automation skills in Python, PowerShell, or Bash for API calls and log parsing.
- Strong troubleshooting mindset and ITIL operational experience (Incident, Change, and Problem Management via ServiceNow/Jira).
Desirable Skills (Nice-to-Haves)
- Cribl Stream Certification (Cribl Certified Admin or User) or CrowdStrike Falcon LogScale / NextGen SIEM certifications.
- Understanding of Log Common Information Models (CIM) and schema mapping standards.
- Exposure to Security Data Fabric, Threat Intelligence feeds, or automated SOAR workflows.
- Familiarity with ServiceNow CMDB, Jira tracking, and building basic operational dashboards.
The employer’s company overview, benefits, equal-opportunity statement and generic skills tables are left out here; they are on the original posting.
Text from Johnson Controls' official job posting, formatted by HireSetu. The employer's own page is the final word on details.
The one real filter
Cribl Stream is the must-have. Routes, pipelines, functions, event breakers and worker groups need to be things you have configured and then repaired when they broke. Logstash, Vector or Fluentd experience is accepted in its place, so a pipeline engineer from an observability or platform team has a genuine route in.
On the SIEM side, depth in one platform is enough: CrowdStrike NextGen SIEM, Azure Log Analytics or Splunk. Cribl and Falcon LogScale certifications sit in the desirable list, a tiebreaker on a CV that already shows operational work.
Security Data Fabric, threat intel feeds, SOAR workflows and ServiceNow CMDB are exposure items. Don't talk yourself out of applying over those.
Parsing logs and watching the bill
Expect health checks and small fixes: a collector goes quiet, an API token expires, a firewall starts sending a field in a new format, and you trace where the flow stopped. Cribl Vision shows up for drop-off detection, so reading flow metrics and finding the gap before the SOC does is the skill that counts.
The FinOps side lifts this above plumbing. You write the filters, dedupe rules and routes that keep Azure Event Hubs storage and SIEM licence use down, and that work runs straight into detection. Dropping a field an analyst depends on is a live risk, and the posting puts you next to the SOC and GRC teams on log ownership and retention. Anyone who has argued about which fields are worth keeping will settle in quickly.
Bengaluru and Pune are both listed, and an ingestion pipeline does not keep office hours, so settle the office and the on-call arrangement early.
Prepared from Johnson Controls' job posting and checked against it before publishing. See our Editorial Policy.
How to apply
- The Apply button opens this job on Johnson Controls' careers site (jci.wd5.myworkdayjobs.com).
- Its requisition number is WD30283070; search for it on the careers site if the link ever stops working.
- Applications close on 2 Dec 2026.
- Workday logins are separate for every company, so you need an account made for Johnson Controls.
Apply on Johnson Controls' site
No fees, ever. HireSetu never charges candidates, and no genuine employer asks for money to apply, interview or join. If anyone asks you to pay, stop and report the job.
Similar openings on HireSetu
- Cyber Security Analyst L1 at Wipro — Bengaluru — Cybersecurity · Full-time
- Security Engineer (L1) at NTT DATA — Mumbai — Software / IT · Full-time
- Engineer – Product Security at Qualcomm — Hyderabad — VLSI · Full-time
- Data Science Associate – AI (S&C Global Network, Hi Tech) at Accenture — Bengaluru — AI / ML · Full-time
- Associate 2 – GTS Engineer (Azure Data Engineering) at KPMG — Bengaluru — Software / IT · Full-time
View Security Data & SIEM Engineer on HireSetu · Cybersecurity jobs · Jobs in Bengaluru · Career Insights · FAQ · Companies