Security operations analyst

India7h ago

Free account needed to apply or save. It takes a minute, and we'll bring you right back to this job.

Skills

awsazureazure monitorcloud securityconfiguration managementendpoint securityentra idgcpincident investigationincident responsemicrosoft 365mitre att&cksecurity monitoringsharepointsiemtechnical documentationthreat detectionthreat intelligencevpc

About the role

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Security Operations Analyst based in India.

In this role, you will play a key part in strengthening enterprise cybersecurity through security operations engineering, threat detection, and automated incident response. You will design, deploy, and maintain security integrations across SIEM, SOAR, endpoint protection, and multi-cloud environments. Working extensively with Palo Alto Cortex and CrowdStrike Falcon, you will help ensure that security telemetry is accurate, actionable, and aligned with evolving threat landscapes. You will collaborate with Security Operations, IT, and infrastructure teams to improve detection capabilities and respond to complex security incidents. The position also involves developing automation workflows, translating threat intelligence into effective detection rules, and maintaining strong security monitoring across cloud and identity platforms. This is an excellent opportunity for a security professional who enjoys hands-on engineering, continuous improvement, and working with modern enterprise security technologies.

Accountabilities:

SIEM and SOAR Engineering: Design, deploy, and maintain log source integrations within Palo Alto Cortex XSIAM and XSOAR, ensuring accurate data normalization, parsing, and quality. Develop and continuously improve SOAR playbooks for automated incident triage, enrichment, and response. Manage detection rules, correlation policies, dashboards, and alert thresholds while optimizing detection accuracy and reducing false positives.
Security Platform Management: Monitor SIEM platform health, connector availability, API rate limits, and log ingestion capacity. Maintain technical documentation, integration runbooks, playbook specifications, and change records in accordance with established change management procedures.
Endpoint Security Engineering: Administer and optimize the CrowdStrike Falcon platform, including endpoint sensor deployment, security policies, and response workflows. Maintain Falcon integrations with SIEM platforms, validate endpoint detection alerts, and support incident investigations using Real Time Response (RTR) capabilities when required.
Multi-Cloud Security Integration: Configure and maintain security log collection across AWS, Microsoft Azure, and Google Cloud Platform. Manage integrations involving AWS GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, Azure Defender for Cloud, Azure Monitor, Entra ID, GCP Cloud Audit Logs, and Security Command Center.
Cloud Security Monitoring: Ensure comprehensive cloud telemetry coverage aligned with security detection requirements and regulatory obligations. Identify and resolve monitoring gaps while maintaining least-privilege IAM roles, service principals, and permissions for log collection.
Identity and Microsoft 365 Security: Maintain and improve security integrations between Microsoft Entra ID and SIEM platforms, including Conditional Access audit logs, risky sign-in alerts, and identity-based detection use cases. Support Microsoft 365 Defender integrations covering Exchange Online, SharePoint, and Teams.
Security Configuration Reviews: Assist with periodic reviews of identity security controls, including multi-factor authentication coverage, guest account management, and privileged role assignments. Coordinate with IT teams and escalate security findings through appropriate governance channels.
SOC Operations and Incident Response: Provide Tier 2/3 engineering support for complex security investigations, helping analysts troubleshoot incidents and improve investigation outcomes.
Threat Detection and Continuous Improvement: Translate threat intelligence and MITRE ATT&CK tactics, techniques, and procedures into actionable detection logic. Contribute to vulnerability and configuration management activities involving SIEM-connected assets.
Reporting and Collaboration: Maintain accurate