Description

Design and build a cloud-native AI/ML observability platform, owning the production-grade SIEM collector pipeline that ingests, normalises, and analyses multi-cloud telemetry for real-time detection and governance.

This role is remote.

Responsibilities

• Architect and implement multi-tenant SIEM Collector pipelines (receivers, processors, exporters) across AWS, Azure, and GCP.
• Build multi-source ingestion from CloudTrail, Azure Monitor, GCP Audit Logs, Splunk, Sentinel, and API logs.
• Normalise telemetry to OpenTelemetry semantic conventions and implement DLQ and replay pipelines.
• Design detection engines using rules and ML-based anomaly detection, including behavioural analytics for entity/data flow modelling.
• Enable real-time alerting, severity classification, and immutable audit logging for usage patterns and risk scoring.

Required Skills

• 15+ years of experience in SIEM, multitenant distributed SaaS applications, and Java microservices.
• Strong expertise with leading SIEM platforms (Splunk, Sentinel, Elastic, Chronicle) and large-scale log processing.
• Hands-on experience with OpenTelemetry (OTel Collector, OTTL) and streaming/data pipelines (Kafka, Kinesis/Event Hub/PubSub, Flink/Kafka Streams).
• Experience with Kubernetes and Infrastructure as Code.
• Proficiency in data warehousing and analytics technologies.
• Working knowledge of ML-based anomaly detection and behavioural analytics.

Key Skills

Education

Any Graduate