SOC Incident Response + Threat Intelligence / Threat Hunting (L4) Position Title L4 Security Lead SOC Incident Response, Threat Intelligence & Threat Hunting Experience 15+ years in Cyber Security Operations, Incident Response, Threat Intelligence, and Threat Hunting Location Flexible / Hybrid / Onsite Role Summary We are looking for an experienced L4 SOC Security Lead with strong expertise in Incident Response (IR), Threat Intelligence (TI), and proactive Threat Hunting. The candidate will act as a senior escalation point for high-severity security incidents, conduct advanced investigations, develop threat hunting hypotheses, and provide actionable intelligence to improve the organizations overall security posture. The role requires hands-on expertise across SIEM, EDR/XDR, network security monitoring, malware analysis, threat intelligence platforms, and cloud security monitoring.

Key Responsibilities Incident Response & Security Operations - Lead investigation and response activities for complex security incidents including:

- Ransomware - Advanced Persistent Threats (APT) - Insider threats - Credential compromise - Web application attacks - Cloud security incidents - Data exfiltration - Lateral movement - Privilege escalation - Perform advanced triage and root cause analysis using:
- SIEM - EDR/XDR - Network telemetry - Threat intelligence feeds - Cloud logs - Endpoint forensics - Leading the IR activity overall and managing client escalations
- Conduct incident containment, eradication, and recovery coordination.
- Develop and improve:
- Incident response playbooks - Detection use cases - Correlation rules - SOC runbooks - Automation workflows - Coordinate with infrastructure, cloud, application, and business teams during major incidents.
- Prepare executive and technical incident reports with actionable recommendations.

Threat Intelligence

Responsibilities - Monitor and analyze cyber threat intelligence from:





- Commercial TI platforms - Open-source intelligence (OSINT) - Government/CERT advisories - Dark web monitoring - Vendor threat reports - Enrich alerts with Indicators of Compromise (IOCs), TTPs, malware intelligence, and adversary attribution.
- Map adversary activities to:
- MITRE ATT&CK; - Cyber Kill Chain - Diamond Model - Analyze emerging threats, zero-days, ransomware campaigns, and targeted attack trends.
- Provide strategic and operational threat advisories to SOC and leadership teams.
- Create threat intelligence reports, executive summaries, and threat landscape assessments.

Threat Hunting

Responsibilities - Conduct proactive threat hunting using hypothesis-driven methodologies.

- Hunt for:
- Persistence mechanisms - Beaconing activity - Credential dumping - Living-off-the-land (LOLBins) - Command & Control (C2) - Suspicious PowerShell activity - Lateral movement - Cloud anomalies - Use telemetry from:
- SIEM - EDR/XDR - DNS - Proxy - Firewall - Identity systems - Cloud platforms - Develop custom queries and analytics for detecting stealthy attacker behavior.
- Identify detection gaps and recommend logging improvements.
- Convert hunt findings into production-grade detection use cases.

Required Technical

Skills SIEM & Security Monitoring Robust hands-on experience with one or more:

- IBM QRadar
- Microsoft Sentinel
- Splunk Enterprise Security
- ArcSight
- LogRhythm EDR/XDR Technologies Experience with:
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
- SentinelOne
- Palo Alto Cortex XDR Threat Intelligence Platforms Experience with:
- Recorded Future
- Anomali ThreatStream




- MISP
- ThreatConnect Cloud & Infrastructure Security Knowledge of:
- Amazon Web Services security monitoring
- Microsoft Azure security services
- Google Cloud Platform logging and detections
- Identity security and IAM monitoring
- Container/Kubernetes security basics Investigation & Analysis Skills - Malware triage and behavioural analysis
- Windows/Linux forensic analysis
- Memory and disk artifact analysis
- Packet analysis using Wireshark
- Threat actor TTP analysis
- IOC enrichment and validation Scripting & Automation Good knowledge of:
- Python
- PowerShell
- KQL
- SPL
- Regex
- API integrations
- SOAR automation Desired Certifications Preferred certifications include:
- GIAC Certified Incident Handler (GCIH)
- GIAC Certified Forensic Analyst (GCFA)
- GIAC Certified Intrusion Analyst (GCIA)
- Certified Threat Intelligence Analyst (CTIA)
- EC-Council Certified Ethical Hacker (CEH)
- ISC2 CISSP
- Security vendor certifications Key Competencies - Strong analytical and investigative mindset
- Excellent communication and stakeholder management
- Ability to work during high-pressure incidents
- Deep understanding of attacker methodologies
- Strong documentation and reporting capability
- Mentoring and guidance for junior analysts
- Ability to independently lead investigations Preferred Exposure - MDR/MSSP environment
- Healthcare / BFSI / Critical infrastructure domains
- Threat hunting frameworks
- Purple team exercises
- MITRE ATT&CK-based; detection engineering
- SOAR platforms and automation
- Cloud-native SOC operations Typical Deliverables - Incident investigation reports / RCA
- Threat intelligence advisories
- Hunting reports and findings
- Detection use cases
- IOC/TTP repositories / MITRE
- Executive risk summaries
- Threat landscape assessments
- SOC maturity improvement recommendations
- Presentation skills
- Communication skills

📌 ARCHITECT - SOC Monitoring (Bengaluru)
🏢 Happiest Minds Technologies
📍 Bengaluru