Security Operations Center

The Apollo Hospitals Family

Set-up in 1983 by Dr. Prathap C. Reddy, renowned as the architect of modern healthcare in India. As the nations first corporate hospital, Apollo Hospitals is acclaimed for pioneering the private healthcare revolution in the country.

Apollo Hospitals has emerged as Asia’s foremost integrated healthcare services provider and has a robust presence across the healthcare ecosystem, including Hospitals, Pharmacies, Primary Care & Diagnostic Clinics and several retail health models. The cornerstones of Apollo’s legacy are its unstinting focus on clinical excellence, affordable costs, modern technology and forward-looking research & academics.

Role Description

The SOC Analyst operates Apollo's 24x7 Security Operations Centre, responsible for real-time monitoring, triage, analysis and response to cybersecurity events across the enterprise IT landscape. Operating in a three-shift plus reliever model, the analyst ensures 100% uptime of SOC tooling, drives reduction in false positives, integrates new log sources and maintains strict adherence to incident response SLAs. The role is central to operationalising the Cyber Security Vision 2.0 and to safeguarding 50+ hospitals, their clinical systems and patient data.

Detailed Job Responsibility & Accountabilities

• Monitor SIEM, EDR, NDR, WAF, email security and identity protection consoles for security events during assigned shift.
• Triage alerts, perform initial analysis, enrich indicators and determine true-positive vs false-positive classification.
• Execute defined playbooks for common incident types (phishing, malware, brute force, data exfiltration attempts).
• Escalate confirmed incidents to L2/L3 and incident commander per incident response workflow.
• Coordinate with local hospital IT teams and OEMs for incident analysis, containment and remediation.
• At L2 level, own end-to-end incident handling, root cause analysis, forensic data collection and closure within SLA.
• Develop and tune detection use cases, correlation rules and playbooks in partnership with SOC engineering.
• Ensure 100% uptime of SOC tooling; raise and track any platform issues to OEMs.
• Integrate new log sources per the onboarding plan; validate parsing, retention and detection coverage.
• Generate shift summary reports, executive dashboards and metrics for management review.
• Participate in threat hunting exercises and purple team drills.
• Maintain strict documentation hygiene in case management and ticketing tools.
• Contribute to awareness campaigns and phishing simulation exercises.

Desired Skills & Competencies

• L1: 2+ years, L2: 5+ years of SOC / security operations experience.
• Must have hands-on experience with leading SIEM platforms (Microsoft Sentinel, Splunk, QRadar, ArcSight).
• Must have working knowledge of EDR (SentinelOne preferred, CrowdStrike, Defender), WAF, DLP and email security platforms.
• Must have understanding of MITRE ATT&CK framework, common attack patterns and threat actor TTPs.
• Must have strong networking fundamentals (TCP/IP, DNS, HTTP, proxies) and operating system basics (Windows, Linux).
• Must have analytical mindset and ability to triage alerts quickly and accurately.
• Preferred certifications: CompTIA Security+, CySA+, GCIA, GCIH, SC-200, or equivalent.
• Comfort with rotating shift schedules (3-shift + reliever model) is essential.

Job Performance Parameters

• 100% uptime of SOC tooling
• Reduction in false positive incident rate
• SLA adherence for alert triage, investigation and escalation
• Log source integration completion per plan
• Mean Time to Detect and Mean Time to Respond
• Quality of shift summary and incident documentation

Managerial and Behavioral Competencies

• Attention to detail and analytical rigour
• Calm under pressure
• Team Spirit and shift collaboration
• Effective Communication during incidents

Continuous learning on evolving threats