Cybersecurity Engineering Specialist

Job Description

We are seeking for Engineering Senior Specialist todesign, engineer, and operate enterprise-scale XDR and SIEM platforms acrossMicrosoft and Google security ecosystems. This role operates at the intersection ofsecurity platform engineering, detection engineering, and operational resilience, with a clear mandate to improvethreat detection quality, response effectiveness, data fidelity, and platform reliability in a global enterprise environment.

The ideal candidate bringsdeep hands-on engineering expertise, anoperations-first mindset, and the ability to collaborate effectively withSOC (CFC), cloud, identity, and infrastructure teams.

Key Responsibilities:

Platform Engineering & Operations

• Engineer, operate, and continuously optimizeMicrosoft Sentinel andMicrosoft Defender XDR (Defender for Endpoint, Identity, Office, and Cloud).

• Engineer and operateGoogle Security Operations (Chronicle SIEM) to support high-volume security telemetry ingestion, analytics, and long-term retention.

• Design and maintainscalable ingestion architectures, including normalization, enrichment, routing, and retention across hybrid and multi-cloud environments.

• Ensure platform reliability, performance, cost awareness, and operational stability.

Detection Engineering & Threat Response Enablement

• Support detection tuning activities to reduce false positives, improve signal-to-noise ratio, and align with SOC workflows.

• Provide deep platform and data expertise to supportincident investigation, threat hunting, and response activities.

• Align detection logic withMITRE ATT&CK and threat-informed defense principles.

Data Quality, Telemetry & Observability

• Support onboarding, validation, parsing, and ongoing quality monitoring of security telemetry sources.

• Partner with application, platform, and infrastructure teams toidentify and close logging and visibility gaps.

• Establish and enforce data quality standards to ensure reliable detection, investigation, and reporting.

• Ensure logging and monitoring practices meetinternal security standards and regulatory requirements.

Automation & Continuous Improvement

• Implement automation fordetection lifecycle management, enrichment, and response orchestration using SOAR and native platform capabilities.

• Drivestandardization, documentation, and runbook development to improve operational maturity and resiliency.

• Contribute to platform roadmaps, reliability improvements, andtechnical debt reduction initiatives.

Collaboration & Governance

• Work closely withCFC/SOC, Cloud Security, Identity, Infrastructure, and Compliance teams.

• Support audit and compliance activities, includingSOX and regulatory log‑retention requirements.

• Provide technical input into onboarding decisions, platform changes, and security architecture reviews.

Required Qualifications:

• 5+ years of experience insecurity engineering, detection engineering, or SOC engineering roles.

• Strong hands-on experience withMicrosoft Sentinel andMicrosoft Defender XDR.

• Experience withGoogle Security Operations (Chronicle SIEM) or equivalent large-scale cloud SIEM platforms.

• Proficiency inKQL and experience authoring structured detection logic.

• Solid understanding ofcloud security (Azure and/or GCP), identity, endpoint, and network telemetry.

• Experience operating security platforms inlarge, complex enterprise environments.

Required Skills:

Preferred Skills:

Current Employees applyHERE

Current Contingent Workers applyHERE

Search Firm Representatives Please Read Carefully 
Merck & Co., Inc., Rahway, NJ, USA, also known as Merck Sharp & Dohme LLC, Rahway, NJ, USA, does not accept unsolicited assistance from search firms for employment opportunities. All CVs / resumes submitted by search firms to any employee at our company without a valid written search agreement in place for this position will be deemed the sole property of our company.  No fee will be paid in the event a candidate is hired by our company as a result of an agency referral where no pre-existing agreement is in place. Where agency agreements are in place, introductions are position specific. Please, no phone calls or emails. 

Employee Status:

Relocation:

VISA Sponsorship:

Travel Requirements:

Flexible Work Arrangements:

Shift:

Valid Driving License:

Hazardous Material(s):

Job Posting End Date:

*A job posting is effective until 11:59:59PM on the dayBEFORE the listed job posting end date. Please ensure you apply to a job posting no later than the dayBEFORE the job posting end date.