ICC - Security Operations Analyst - Cyber Defense

Team: IT

Location: India

Commitment: Full-time

Workplace Type: remote

Accountabilities

• Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security technologies, and cloud platforms.

• Analyze logs and security events from Windows and Linux systems, databases, applications, web servers, firewalls, and network intrusion detection systems.

• Investigate suspicious activity, determine potential root causes, and assess the severity and impact of security incidents.

• Support incident response, remediation, recovery, and containment activities in coordination with relevant cybersecurity teams.

• Determine appropriate escalation paths and collaborate with Incident Response specialists when threats require deeper investigation.

• Identify opportunities to improve detection quality, optimize security monitoring, reduce false positives, and tune whitelists.

• Prepare technical reports, investigation summaries, and security findings for relevant stakeholders.

• Maintain SOC procedures, technical documentation, playbooks, and knowledge-base content.

• Contribute to operational improvements, process optimization, and cybersecurity quality initiatives.

Requirements

• 5+ years of relevant IT and/or cybersecurity experience, with hands-on experience in security operations.

• Proven experience with security alert triage, threat investigation, and incident response processes.

• Practical experience working with SIEM and EDR platforms in enterprise environments.

• Strong log analysis capabilities across Windows/Linux systems and broader enterprise infrastructure.

• Deep knowledge of Microsoft Security technologies.

• Experience with at least one major cloud environment, such as Azure, AWS, or GCP.

• Experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, ArcSight, or ELK.

• Experience with EDR solutions such as Microsoft Defender for Endpoint or CrowdStrike.

• Knowledge of email security, network monitoring, threat detection, and incident response.

• Strong knowledge of Linux, macOS, and Windows operating systems.

• Fluent English with strong written and verbal communication skills.

• Ability to work effectively within global, distributed cybersecurity teams and coordinate investigations across different functions.

Nice to Have

• Tier 1 or Tier 2 incident response experience.

• Experience with AWS security monitoring across IaaS, PaaS, or SaaS environments.

• Scripting experience with Python, PowerShell, Bash, Ruby, or similar languages.

• Relevant certifications such as SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE.

• Previous experience working in a global SOC or distributed cybersecurity operation.

Benefits

• Full-time remote work from India.

• Six-month contract with potential for extension.

• Opportunity to work within a global 24/7 Security Operations Centre.

• Exposure to a broad cybersecurity technology stack spanning SIEM, EDR, cloud, network, endpoint, and enterprise security.

• Collaboration with cybersecurity specialists across multiple regions and technical disciplines.

• Hands-on experience with real-world threat detection, investigation, incident response, and remediation.

• Opportunity to contribute to security monitoring optimization and operational improvement initiatives.

• Globally distributed and remote-first working environment.

• Inclusive and transparent recruitment environment.