Sr IT Cyber Defense Analyst

Accountabilities

Lead daily SOC shift operations, prioritize security alerts, manage escalations, coordinate incident handling, and ensure timely shift handovers and compliance with service-level agreements (SLAs).
Investigate complex cybersecurity incidents involving phishing, malware, ransomware, compromised accounts, endpoint threats, and suspicious network activity.
Conduct proactive threat hunting by correlating security telemetry, identifying attack patterns, and mapping adversary behavior to the MITRE ATT&CK framework.
Develop, optimize, and troubleshoot SIEM queries, analytics rules, and detection use cases using Microsoft Sentinel and Kusto Query Language (KQL).
Leverage approved AI and large language model (LLM) tools to support alert triage, investigations, threat intelligence enrichment, KQL development, incident reporting, and workflow automation.
Independently validate AI-generated queries, scripts, and recommendations to ensure accuracy, security, reliability, and compliance with data privacy requirements.
Automate repetitive SOC processes using Python, PowerShell, APIs, and Security Orchestration, Automation, and Response (SOAR) capabilities.
Mentor SOC analysts, improve investigation quality, strengthen team capabilities, and promote consistent operational practices.
Review detection performance, reduce false positives, identify coverage gaps, and continuously improve security monitoring and incident response workflows.
Maintain accurate incident records, investigation reports, and audit-ready evidence to support compliance, operational transparency, and post-incident reviews.
Collaborate with Incident Response, IT, Endpoint, Network, and Cloud teams to coordinate threat containment, remediation, recovery, and follow-up actions.
Promote the responsible adoption of AI and automation while maintaining human oversight and sound cybersecurity judgment.
Support continuous improvement initiatives to enhance detection coverage, investigation efficiency, and overall SOC performance.
Requirements
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related discipline, or equivalent practical experience.
At least 5 years of professional experience in a Security Operations Center (SOC), cyber defense, or incident response, including experience in shift leadership, incident coordination, or analyst mentoring.
Strong hands-on expertise in security information and event management (SIEM), endpoint detection and response (EDR), extended detection and response (XDR), security investigations, and threat detection.
Proficiency in Microsoft Sentinel and Kusto Query Language (KQL), including the development and optimization of queries, analytics rules, and detection use cases.
Experience with Microsoft Defender, CrowdStrike, or comparable enterprise security platforms.
Strong understanding of networking, Windows and Linux environments, identity security, email-based threats, and common attack techniques.
Practical knowledge of the MITRE ATT&CK framework and its application to threat hunting, investigation, and detection engineering.
Mandatory AI/LLM proficiency, including prompt engineering, AI-assisted investigations, and the ability to validate AI-generated queries and scripts.
Awareness of AI-related security and reliability risks, including hallucinations, prompt injection, and data privacy concerns.
Scripting and automation experience using Python, PowerShell, APIs, or SOAR tools to improve operational efficiency and reduce repetitive tasks.
Strong analytical and problem-solving skills, with the ability to investigate complex incidents, assess risk, and make sound decisions under pressure.
Demonstrated leadership, communication, and collaboration skills, including the ability to mentor analysts and coordinate cross-functional incident response.
Strong documentation skills and a commitment to maintaining accurate investigation records and consistent operational standards.
Willingness and ability to work in a 24/7 rotational shift environment and support effective shift handovers and incident escalation.
Preferred: Certifications such as Microsoft SC-200, CompTIA CySA+, GCIH, or relevant SIEM/EDR vendor certifications.
Preferred: Experience in proactive threat hunting, detection engineering, cloud security, and SOC process improvement.
Benefits
Fully remote work arrangement based in India, with the designated location listed as Pune or Baroda.
Full-time employment opportunity within an established healthcare technology environment.
Opportunity to lead security operations and contribute to the protection of critical IT systems and services.
Hands-on exposure to AI-enabled cybersecurity tools, advanced threat detection technologies, and security automation.
Opportunities to strengthen expertise in Microsoft Sentinel, KQL, EDR/XDR platforms, threat hunting, and incident response.
Professional development opportunities through complex security investigations, detection engineering, and continuous improvement initiatives.
Collaborative work with cybersecurity, infrastructure, endpoint, network, cloud, and incident response professionals.
Opportunity to mentor team members and influence SOC processes, security standards, and operational performance.