? SOC Incident Response + Threat Intelligence / Threat Hunting (L4)

Position Title

L4 Security Lead ? SOC Incident Response, Threat Intelligence & Threat Hunting

Experience

15+ years in Cyber Security Operations, Incident Response, Threat Intelligence, and Threat Hunting

Location

Versatile / Hybrid / Onsite

Role Summary

We are looking for an experienced L4 SOC Security Lead with strong expertise in Incident Response (IR), Threat Intelligence (TI), and proactive Threat Hunting. The candidate will act as a senior escalation point for high-severity security incidents, conduct advanced investigations, develop threat hunting hypotheses, and provide actionable intelligence to improve the organization?s overall security posture.

The role requires hands-on expertise across SIEM, EDR/XDR, network security monitoring, malware analysis, threat intelligence platforms, and cloud security monitoring.

Key Responsibilities

Incident Response & Security Operations

Lead investigation and response activities for complex security incidents including: Ransomware

Advanced Persistent Threats (APT)

Insider threats

Credential compromise

Web application attacks

Cloud security incidents

Data exfiltration

Lateral movement

Privilege escalation

Perform advanced triage and root cause analysis using: SIEM

EDR/XDR

Network telemetry

Threat intelligence feeds

Cloud logs

Endpoint forensics

Leading the IR activity overall and managing client escalations

Conduct incident containment, eradication, and recovery coordination.

Develop and improve: Incident response playbooks

Detection use cases

Correlation rules

SOC runbooks

Automation workflows

Coordinate with infrastructure, cloud, application, and business teams during major incidents.

Prepare executive and technical incident reports with actionable recommendations.

Threat Intelligence Responsibilities

Monitor and analyze cyber threat intelligence from: Commercial TI platforms





Open-source intelligence (OSINT)

Government/CERT advisories

Dark web monitoring

Vendor threat reports

Enrich alerts with Indicators of Compromise (IOCs), TTPs, malware intelligence, and adversary attribution.

Map adversary activities to: MITRE ATT&CK;

Cyber Kill Chain

Diamond Model

Analyze emerging threats, zero-days, ransomware campaigns, and targeted attack trends.

Provide strategic and operational threat advisories to SOC and leadership teams.

Create threat intelligence reports, executive summaries, and threat landscape assessments.

Threat Hunting Responsibilities

Conduct proactive threat hunting using hypothesis-driven methodologies.

Hunt for: Persistence mechanisms

Beaconing activity

Credential dumping

Living-off-the-land (LOLBins)

Command & Control (C2)

Suspicious PowerShell activity

Lateral movement

Cloud anomalies

Use telemetry from: SIEM

EDR/XDR

DNS

Proxy

Firewall

Identity systems

Cloud platforms

Develop custom queries and analytics for detecting stealthy attacker behavior.

Identify detection gaps and recommend logging improvements.

Convert hunt findings into production-grade detection use cases.

Required Technical Skills

SIEM & Security Monitoring

Strong hands-on experience with one or more:

IBM QRadar

Microsoft Sentinel

Splunk Enterprise Security

ArcSight

LogRhythm

EDR/XDR Technologies

Experience with

CrowdStrike Falcon

Microsoft Defender for Endpoint

SentinelOne

Palo Alto Cortex XDR

Threat Intelligence Platforms

Experience with

Recorded Future





Anomali ThreatStream

MISP

ThreatConnect

Cloud & Infrastructure Security

Knowledge of

Amazon Web Services security monitoring

Microsoft Azure security services

Google Cloud Platform logging and detections

Identity security and IAM monitoring

Container/Kubernetes security basics

Investigation & Analysis Skills

Malware triage and behavioural analysis

Windows/Linux forensic analysis

Memory and disk artifact analysis

Packet analysis using Wireshark

Threat actor TTP analysis

IOC enrichment and validation

Scripting & Automation

Good knowledge of

Python

PowerShell

KQL

SPL

Regex

API integrations

SOAR automation

Desired Certifications

Preferred certifications include

GIAC Certified Incident Handler (GCIH)

GIAC Certified Forensic Analyst (GCFA)

GIAC Certified Intrusion Analyst (GCIA)

Certified Threat Intelligence Analyst (CTIA)

EC-Council Certified Ethical Hacker (CEH)

ISC2 CISSP

Security vendor certifications

Key Competencies

Strong analytical and investigative mindset

Excellent communication and stakeholder management

Ability to work during high-pressure incidents

Deep understanding of attacker methodologies

Strong documentation and reporting capability

Mentoring and guidance for junior analysts

Ability to independently lead investigations

Preferred Exposure

MDR/MSSP environment

Healthcare / BFSI / Critical infrastructure domains

Threat hunting frameworks

Purple team exercises

MITRE ATT&CK-based; detection engineering

SOAR platforms and automation

Cloud-native SOC operations

Typical Deliverables

Incident investigation reports / RCA

Threat intelligence advisories

Hunting reports and findings

Detection use cases

IOC/TTP repositories / MITRE

Executive risk summaries

Threat landscape assessments

SOC maturity improvement recommendations

Presentation skills

Communication skills

📌 ARCHITECT - SOC Monitoring (Bengaluru)
🏢 Happiest Minds Technologies
📍 Bengaluru