ICC - Security Operations Analyst - Cyber Defense

Accountabilities

• • Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security technologies, and cloud platforms.

  • Analyze logs and security events from Windows and Linux systems, databases, applications, web servers, firewalls, and network intrusion detection systems.

  • Investigate suspicious activity, determine potential root causes, and assess the severity and impact of security incidents.

  • Support incident response, remediation, recovery, and containment activities in coordination with relevant cybersecurity teams.

  • Determine appropriate escalation paths and collaborate with Incident Response specialists when threats require deeper investigation.

  • Identify opportunities to improve detection quality, optimize security monitoring, reduce false positives, and tune whitelists.

  • Prepare technical reports, investigation summaries, and security findings for relevant stakeholders.

  • Maintain SOC procedures, technical documentation, playbooks, and knowledge-base content.

  • Contribute to operational improvements, process optimization, and cybersecurity quality initiatives.

  Requirements

  • 5+ years of relevant IT and/or cybersecurity experience, with hands-on experience in security operations.

  • Proven experience with security alert triage, threat investigation, and incident response processes.

  • Practical experience working with SIEM and EDR platforms in enterprise environments.

  • Strong log analysis capabilities across Windows/Linux systems and broader enterprise infrastructure.

  • Deep knowledge of Microsoft Security technologies.

  • Experience with at least one major cloud environment, such as Azure, AWS, or GCP.

  • Experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, ArcSight, or ELK.

  • Experience with EDR solutions such as Microsoft Defender for Endpoint or CrowdStrike.

  • Knowledge of email security, network monitoring, threat detection, and incident response.

  • Strong knowledge of Linux, macOS, and Windows operating systems.

  • Fluent English with strong written and verbal communication skills.

  • Ability to work effectively within global, distributed cybersecurity teams and coordinate investigations across different functions.

  Nice to Have

  • Tier 1 or Tier 2 incident response experience.

  • Experience with AWS security monitoring across IaaS, PaaS, or SaaS environments.

  • Scripting experience with Python, PowerShell, Bash, Ruby, or similar languages.

  • Relevant certifications such as SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE.

  • Previous experience working in a global SOC or distributed cybersecurity operation.

  Benefits

  • Full-time remote work from India.

  • Six-month contract with potential for extension.

  • Opportunity to work within a global 24/7 Security Operations Centre.

  • Exposure to a broad cybersecurity technology stack spanning SIEM, EDR, cloud, network, endpoint, and enterprise security.

  • Collaboration with cybersecurity specialists across multiple regions and technical disciplines.

  • Hands-on experience with real-world threat detection, investigation, incident response, and remediation.

  • Opportunity to contribute to security monitoring optimization and operational improvement initiatives.

  • Globally distributed and remote-first working environment.

  • Inclusive and transparent recruitment environment.