Forward Deployed Engineer, Pharma / OT

HyderabadGo to marketFull time, on site at manufacturing plants

The enterprise has no trustworthy map of itself. Agents are about to make that fatal.

Indian pharma manufacturing is being pushed off its SIEM at the same moment CDSCO, 21 CFR Part 11 and DPDP are turning “the data left the plant” into a deal killer. QRadar’s roadmap is unclear to the people who bought it, and Splunk renewals are landing on desks as evaluations. The floor is air gapped, the historian has never forwarded a packet, and a US hosted platform cannot follow anyone into that room.

Samyoga reads security data where it already lives and builds a graph of humans, machines and OT on top of it. Fully air gapped, local model, no outbound calls. That configuration is in production on pharma manufacturing floors today. It is also the configuration that gets us the meeting.

We are hiring the first forward deployed engineer for this sector. You are not a slide sales engineer. You stand the product up on their lake, on their floor, on their rules.

This is not the Mumbai BFSI sales engineer seat. Do not apply to both and pick later.

What you would own

Scope and run the proof of concept yourself. Collector or connector in, and their FortiGate, Trellix, Cortex, Active Directory, historian and whatever else they actually emit flowing. Detection proved on their data, not on our demo tenant.
Get log sources onboarded that have never been asked to leave the plant. Parse them, map them, and do not wait for a professional services team that does not exist.
Sit next to their SOAR rather than instead of it. One playbook that takes a Samyoga campaign and opens the ticket their SOC already uses is worth more than a deck about integration.
Answer the questions that decide pharma deals: 21 CFR Part 11, CDSCO, Schedule M and GMP, DPDP, data residency, and whether a given log ever crosses the air gap. A packet capture is an acceptable answer.
Own the technical scorecard in an RFP or a head to head evaluation, including the architecture and the runbook their own team uses after go live.
Bring the field back to engineering in the same week. The parser that drops a field their SOC cares about is your bug, not a ticket.

A week that goes well

Monday you are in Genome Valley walking a plant CISO through why an alert that three other tools called low severity is the only campaign that can actually reach a batch release system. Wednesday you are on the floor with their OT engineer, getting syslog off a historian that has never forwarded anything to anyone. Thursday they ask whether any of this leaves India, and you answer with the air gap architecture instead of a slide. Friday you tell our engineering team that a parser is eating a vendor specific field, and it is fixed before the next proof of concept starts.

What we are looking for

You can name all three of these, out loud, in two minutes, from a proof of concept you personally ran.

Log sources you onboarded. Not “we ingested telemetry.” The sources, the parser, and what broke.
A SOAR product and one playbook you wrote yourself. XSOAR, Phantom, Demisto, Sentinel Logic Apps or equivalent. What it did, and what it called.
A SIEM migration. A named platform you moved off and a named platform you moved to, with the log source mapping and the detection rewrite, not a license swap.

If you cannot name all three, this is not your role. Pharma is preferred rather than required, because the person who has all three and a plant floor behind them may not exist. Those three are the gate.

What else has to be true

You have run a SIEM or XDR proof of concept yourself. Not scoped it from a deck. Run it.
You can read a log, write a query, and follow a detection from raw event to alert. A terminal, Linux and containers are ordinary to you.
Hyderabad based, and content to spend most of the week on manufacturing sites, including air gapped floors with no phone signal and a visitor badge that takes an hour.

Useful, not required

Time on an Indian pharma manufacturing floor, a Genome Valley plant, or any air gapped OT segment. A pharma captive centre in Hyderabad is the right stack and the wrong site type. Say so if that is what you have, and we will not pretend it was a plant.
Depth in Splunk, QRadar, Sentinel, Cortex XSIAM or Securonix, from either side of the table. Cribl or hand written parsers are a plus.
Historian, PLC, SCADA or Purdue model vocabulary you did not learn from a diagram.
Kubernetes, and deployments where the network was constrained or absent.
Having survived a bake off you lost, and knowing exactly why.

Compensation and logistics

Market competitive base with a variable component, plus equity that is meaningful for a founding hire. We share the range and the equity detail on the first call rather than after four rounds.

Hyderabad based, on site at customer plants, reporting to the founder.

How we hire

A 30 minute call with the founder. You get the honest version of stage, runway and pipeline, and you should ask for it.
A working session. We hand you a real plant floor environment sketch and you scope the proof of concept out loud: sources, parser, the air gap constraint, and what you would prove in two weeks. No slides, no take home exercise.
A technical deep dive with engineering on the product as it actually is, with access to a live instance.
Two reference conversations of your choosing, then an offer. The whole process fits inside two weeks if we both move.

In the working session we ask for the three names: the log sources, the SOAR playbook, and the SIEM you moved off along with the one you moved to. If they do not come in two minutes, we stop there and say so.

Read this part twice

Who this is wrong for

You are a CISO, or a plant CISO. You know the buyer better than we do, and you would still not be our first forward deployed engineer.
You run a SOC engineering function at a nine thousand person captive centre and you want to keep running one. This is a founding individual contributor seat at a ten person company.
You have only ever onboarded logs in a bank SOC, and pharma is a vertical you would pick up. The air gap, the historian and 21 CFR Part 11 are the job, not the context.
You want a qualified pipeline, a brand that opens the door, or a clean line between presales and debugging a parser at nine at night.
You want a finished product. It is in production and it is early. Both of those are true at once.

If that list reads as a warning rather than an attraction, this is not your role, and we would both rather find that out now.

How to apply

Email [email protected] with the subject line “FDE Pharma Hyderabad.” Tell us about one proof of concept you ran: what you were replacing, the log sources you onboarded, the SOAR playbook you wrote, and the SIEM you moved off. A short note beats a long resume. A resume is fine too.

Apply for this role Read what we are arguing

Posted September 3, 2026