Assistant Manager - Cybersecurity Operations

Tata Communications Redefines Connectivity with Innovation and IntelligenceDriving the next level of intelligence powered by Cloud, Mobility, Internet of Things, Collaboration, Security, Media services and Network services, we at Tata Communications are envisaging a New World of Communications

Broad outline of the Role

• The role is responsible for managing customer queries and operations. This is an operational role that may seek appropriate level of guidance and advice to ensure delivery of quality outcomes.
• Experience in SIEM Tool like Palo Alto XSIEM LogRhythm SIEM, Threat Intelligence, Malware Analysis, Incident Response
• Responsible for the technical Administration or troubleshooting in SIEM ensuring the efficient functionality of the solution
• Responsible for Incident Validation, Incident Analysis, Solution Recommendation,
• Good knowledge on implementation, installation, integration troubleshooting and overall functionalities of LogRhythm,
• LogRhythm rule base fine tuning, Ongoing log source modifications, Configuration/policy changes, General SIEM Administration, SIEM Content Development
• Troubleshooting of an incident within IT Security incident response teams of SOC.
• Apply investigation techniques to document root cause and impact of detected computer security incidents
• Maintains awareness of new and emerging cyber-attack threats with potential to harm company systems and networks. Devises and implements countermeasures to mitigate potential security threats.
• Assists with the development and maintenance of IT security measurement and reporting systems to aid in monitoring effectiveness of IT Security programs.
• Assists with the development, revision, and maintenance of Standard Operating Procedures and Working Instructions related to IT Security.
• Good Coordination skills with various other teams for faster resolution/completion.
• Good to have threat hunting knowledge.

Minimum Qualifications & Experience

• Graduate with 6-8 years of experience

Other Knowledge & Skills

• BE/B.Tech or equivalent with minimum 6-8 years of experience
• Work experience in SOC Incident Handling, Incident Response Trend Analysis, administration/monitroing of SIEM Tool like Palo Alto XSIEM, LogRhythm SIEM, Threat Intelligence, Malware Analysis,
• Ability to adapt and follow the processes and guidelines
• Possess an impeccable work ethic and a high degree of integrity
• Good Analytical & Problem-Solving skills
• Able to communicate with technical staff/management
• Flexible to work in 24/7 environments
• Highly motivated & customer centric
• Maintain awareness of latest technologies in the domain

Key Responsibilities

Ø Incident Handling & Analysis

Take over prioritized alerts from L1 and perform detailed analysis of suspicious or confirmed incidents

Conduct deep-dive investigations using logs, correlation rules, and threat intelligence

Validate critical alerts true positive or false positive

Identify attack patterns such as lateral movement, persistence, and privilege escalation

Provide clear, actionable insights along with containment and remediation recommendations for critical alerts

Ø Investigation & Evidence Management

Provide audit-ready log evidence and maintain proper investigation artifacts

Perform cross-correlation analysis (including advanced analytics like RhythmX in LogRhythm)

Deliver detailed investigation reports with timelines and impact assessment

Ø Proactive Detection

Perform IOC-based and deep-analysis using IOC/ pattern to detect anomalies

Identify hidden or undetected threats beyond existing correlation rules and suggest L3 team on creation

Recommend and implement new detection use cases and rule enhancements

Ø Use Case Tuning & Optimization

Fine-tune rules suggestion to L3 to reduce noise and improve detection efficiency

Continuously improve alert accuracy by minimizing false positives and false negatives

Ø Log Source & Platform Support

Supporting log management activities including archival and restoration

Work with L3 if needed to troubleshoot log ingestion issues (missing logs, delays, parsing failures)

Ensure proper log normalization and data availability for analysis

Ø Incident Response Support (Critical Cases)

Recommend and guide containment actions such as:

• Blocking malicious IPs/domains

• Isolating compromised endpoints

• Disabling compromised user accounts

Ø Process Improvement & Documentation

Create and maintain playbooks, SOPs, and investigation procedures

Ensure documentation is up to date for operational consistency

Ø Quality Assurance & L1 Enablement

Review and validate L1 escalations and tickets for accuracy and completeness

Provide feedback and guidance to improve L1 monitoring and detection quality

Ø Collaboration & Escalation Management

Act as a bridge between L1 (monitoring team) and L3 (SME/support teams)

Coordinate effectively for issue resolution, escalations, and platform improvements