India
Onsite
This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Security Operations Analyst based in India.
In this role, you will play a key part in strengthening enterprise cybersecurity through security operations engineering, threat detection, and automated incident response. You will design, deploy, and maintain security integrations across SIEM, SOAR, endpoint protection, and multi-cloud environments. Working extensively with Palo Alto Cortex and CrowdStrike Falcon, you will help ensure that security telemetry is accurate, actionable, and aligned with evolving threat landscapes. You will collaborate with Security Operations, IT, and infrastructure teams to improve detection capabilities and respond to complex security incidents. The position also involves developing automation workflows, translating threat intelligence into effective detection rules, and maintaining strong security monitoring across cloud and identity platforms. This is an excellent opportunity for a security professional who enjoys hands-on engineering, continuous improvement, and working with modern enterprise security technologies.
SIEM and SOAR Engineering: Design, deploy, and maintain log source integrations within Palo Alto Cortex XSIAM and XSOAR, ensuring accurate data normalization, parsing, and quality. Develop and continuously improve SOAR playbooks for automated incident triage, enrichment, and response. Manage detection rules, correlation policies, dashboards, and alert thresholds while optimizing detection accuracy and reducing false positives.
Security Platform Management: Monitor SIEM platform health, connector availability, API rate limits, and log ingestion capacity. Maintain technical documentation, integration runbooks, playbook specifications, and change records in accordance with established change management procedures.
Endpoint Security Engineering: Administer and optimize the CrowdStrike Falcon platform, including endpoint sensor deployment, security policies, and response workflows. Maintain Falcon integrations with SIEM platforms, validate endpoint detection alerts, and support incident investigations using Real Time Response (RTR) capabilities when required.
Multi-Cloud Security Integration: Configure and maintain security log collection across AWS, Microsoft Azure, and Google Cloud Platform. Manage integrations involving AWS GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, Azure Defender for Cloud, Azure Monitor, Entra ID, GCP Cloud Audit Logs, and Security Command Center.
Cloud Security Monitoring: Ensure comprehensive cloud telemetry coverage aligned with security detection requirements and regulatory obligations. Identify and resolve monitoring gaps while maintaining least-privilege IAM roles, service principals, and permissions for log collection.
Identity and Microsoft 365 Security: Maintain and improve security integrations between Microsoft Entra ID and SIEM platforms, including Conditional Access audit logs, risky sign-in alerts, and identity-based detection use cases. Support Microsoft 365 Defender integrations covering Exchange Online, SharePoint, and Teams.
Security Configuration Reviews: Assist with periodic reviews of identity security controls, including multi-factor authentication coverage, guest account management, and privileged role assignments. Coordinate with IT teams and escalate security findings through appropriate governance channels.
SOC Operations and Incident Response: Provide Tier 2/3 engineering support for complex security investigations, helping analysts troubleshoot incidents and improve investigation outcomes.
Threat Detection and Continuous Improvement: Translate threat intelligence and MITRE ATT&CK tactics, techniques, and procedures into actionable detection logic. Contribute to vulnerability and configuration management activities involving SIEM-connected assets.
Reporting and Collaboration: Maintain accurate security monitoring metrics and contribute to weekly and monthly SOC reports. Work closely with Security Operations, IT, and infrastructure teams to improve detection capabilities, operational efficiency, and incident response processes.
Hands-on experience in Security Operations, SIEM/SOAR engineering, security monitoring, or a related cybersecurity discipline.
Strong technical expertise in SIEM and SOAR platforms, particularly Palo Alto Cortex XSIAM and XSOAR.
Experience designing and maintaining log integrations, data parsing, normalization, detection rules, correlation policies, and automated response playbooks.
Practical experience administering endpoint detection and response platforms, particularly CrowdStrike Falcon, including sensor management, policy configuration, and incident response.
Strong understanding of cloud security logging and monitoring across AWS, Microsoft Azure, and Google Cloud Platform.
Familiarity with AWS security services, including GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, EventBridge, SQS, and SNS.
Knowledge of Azure security technologies, including Microsoft Defender for Cloud, Azure Monitor, and Microsoft Entra ID.
Experience with GCP Cloud Audit Logs, Security Command Center, and Pub/Sub-based logging integrations is desirable.
Understanding of Microsoft 365 security monitoring, including Exchange Online, SharePoint, Teams, Conditional Access, and identity-related security events.
Knowledge of identity and access management principles, privileged access controls, MFA, and least-privilege security practices.
Ability to investigate complex security incidents, perform technical troubleshooting, and support Tier 2/3 SOC operations.
Familiarity with threat intelligence, MITRE ATT&CK frameworks, and detection engineering methodologies.
Strong documentation, analytical, problem-solving, and communication skills.
Ability to collaborate effectively with security analysts, IT professionals, and infrastructure engineering teams.
Understanding of security governance, change management procedures, and regulatory compliance requirements.
Opportunity to work with modern enterprise cybersecurity technologies and platforms.
Hands-on exposure to Palo Alto Cortex XSIAM/XSOAR and CrowdStrike Falcon.
Experience working across multi-cloud security environments, including AWS, Azure, and GCP.
Opportunity to contribute to advanced threat detection, automated incident response, and security engineering initiatives.
Collaboration with international Security Operations and IT teams.
Exposure to complex enterprise security environments and evolving cybersecurity challenges.
Opportunities to strengthen technical expertise in SIEM, SOAR, endpoint security, cloud security, and identity protection.
Equal employment opportunity regardless of race, gender, age, religion, disability, sexual orientation, or other legally protected characteristics.
