SecOps Engineer

SecOps Engineer

Experience: 5+ years in security operations

You will own detection, incident response and day-to-day hardening across our production and corporate environments. The role suits someone who has handled real incidents end to end and wants to reduce how often they happen.

Responsibilities

• Monitor, triage and investigate alerts from SIEM, EDR, cloud and network sources.
• Own incidents from detection through containment, eradication, recovery and post-incident review.
• Build and tune detection rules and correlation searches to raise signal and cut false positives.
• Write and maintain incident response runbooks, and automate repeat response steps with SOAR or scripts.
• Run vulnerability management: scan, prioritise by risk, and track remediation with engineering teams to agreed SLAs.
• Harden cloud, Kubernetes, CI/CD and endpoint configurations against CIS benchmarks.
• Run threat hunts based on MITRE ATT&CK techniques and current threat intelligence.
• Keep log coverage, retention and integrity adequate for investigation and audit.
• Provide evidence and control walkthroughs for ISO 27001 and SOC 2 audits.
• Take part in the on-call rotation for security incidents.

Required skills

• 5+ years in a SOC, incident response or security operations role, with hands-on ownership of incidents.
• SIEM query and detection writing in at least one of Splunk, Microsoft Sentinel, Elastic Security or Wazuh.
• EDR or XDR operation, such as CrowdStrike, Microsoft Defender or SentinelOne.
• Cloud security monitoring on AWS or Azure: IAM, CloudTrail, GuardDuty, Security Hub or their equivalents.
• Strong Linux and networking fundamentals: TCP/IP, DNS, TLS, proxies and firewalls.
• Working knowledge of containers and Kubernetes from a security and logging standpoint.
• Scripting in Python, Bash or PowerShell for automation and log analysis.
• Vulnerability scanning with tools such as Nessus, Qualys or Trivy.
• Familiarity with MITRE ATT&CK and the NIST incident response lifecycle.
• Clear written communication for incident reports and root-cause analyses.

Good to have

• SOAR platform experience, such as Cortex XSOAR, Splunk SOAR or Tines.
• Digital forensics and malware triage skills.
• Detection-as-code practice using Sigma rules and Git-based workflows.
• Certifications: GCIH, GCIA, CySA+, AWS Security Specialty or CEH.

Pay: ₹329,000.00 - ₹1,430,000.00 per year

Work Location: In person