We are seeking a highly skilled and hands-on Senior Cyber Security Engineer to strengthen the organizations security posture across endpoints, networks, cloud environments, identities, applications, and critical infrastructure.

The role will be responsible for EDR management, SIEM/SOAR use-case development, threat intelligence, vulnerability management, cloud security, incident response, threat hunting, security monitoring, and compliance support. The candidate should be capable of handling security incidents end-to-end, improving detection capabilities, reducing false positives, mentoring junior analysts, and working closely with IT, infrastructure, cloud, application, and compliance teams.

This is a senior operational and engineering role. The candidate must be comfortable working in a agile security environment where critical incidents may require rotational shift support, on-call availability, weekend support, or late-night emergency response, depending on business and security requirements.

Key Responsibilities

1. Endpoint Detection and Response

- Lead the deployment, administration, monitoring, and optimization of EDR platforms such as CrowdStrike, SentinelOne, Microsoft Defender, Tanium, Cisco AMP, or similar tools.
- Investigate endpoint alerts involving malware, ransomware, suspicious PowerShell, lateral movement, privilege escalation, credential theft, and unauthorized access.
- Perform endpoint containment, isolation, quarantine, and remediation activities based on incident severity.
- Tune EDR policies and detections to reduce false positives and improve detection accuracy.
- Build and maintain endpoint investigation playbooks and response procedures.

2. SIEM, SOAR and Detection Engineering

- Develop, tune, and maintain SIEM correlation rules, alerts, dashboards, and reports.
- Work with platforms such as Wazuh, Splunk, Microsoft Sentinel, Securonix, QRadar, or similar SIEM tools.
- Onboard and validate log sources from endpoints, firewalls, cloud platforms, identity systems, servers, applications, and network devices.
- Create and improve detection use cases mapped to frameworks such as MITRE ATT&CK;.
- Build and maintain SOAR playbooks for automation of repetitive SOC tasks, alert enrichment, phishing response, IOC blocking, and incident workflows.
- Continuously reduce false positives and improve alert quality.

3. Threat Intelligence and Threat Hunting

- Build and manage a practical threat intelligence program using internal and external intelligence sources.
- Convert threat intelligence into actionable detections, watchlists, IOCs, SIEM rules, EDR queries, and hunting activities.
- Conduct proactive threat hunting across endpoints, network logs, identity logs, cloud logs, and email security platforms.
- Track threat actor TTPs, malware campaigns, phishing campaigns, ransomware trends, and industry-specific threats.
- Maintain threat intelligence reports and share relevant insights with internal stakeholders.

4.



Incident Response and Forensics

- Lead investigation and response for security incidents across endpoint, network, cloud, identity, email, and application environments.
- Act as incident lead / incident commander for high-severity incidents.
- Perform triage, containment, eradication, recovery, RCA, and post-incident review.
- Preserve evidence, collect forensic artifacts, and maintain proper incident documentation.
- Prepare incident reports including timeline, impact, root cause, corrective actions, and preventive controls.
- Coordinate with IT, infrastructure, cloud, application, legal, compliance, and management teams during major incidents.
- Maintain and periodically test incident response playbooks for malware, ransomware, phishing, account compromise, data leakage, cloud compromise, and insider threats.

5. Network Security

- Design, implement, monitor, and improve network security controls including firewalls, IDS/IPS, WAF, VPN, proxy, DNS security, and DDoS protection.
- Investigate suspicious network activity such as port scanning, command-and-control traffic, data exfiltration, unusual outbound traffic, DNS tunneling, brute-force attempts, and lateral movement.
- Review firewall and network security rules for risk, redundancy, and compliance.
- Work with network teams to strengthen segmentation, secure remote access, and reduce attack surface.
- Support security monitoring for both north-south and east-west traffic.

6. Cloud Security

- Oversee security controls across AWS, Azure, and Google Cloud Platform.
- Monitor and secure cloud workloads, IAM, storage, network security groups, cloud firewalls, logging, key management, and cloud-native security tools.
- Review and remediate cloud misconfigurations such as public storage, excessive privileges, exposed secrets, insecure security groups, and weak logging.
- Work with tools such as AWS GuardDuty, AWS Security Hub, Azure Defender for Cloud, Microsoft Entra ID, GCP Security Command Center, CSPM tools, or similar platforms.
- Investigate cloud security incidents including leaked access keys, suspicious API calls, risky sign-ins, privilege abuse, and exposed assets.
- Support secure cloud deployment practices and coordinate with DevOps / cloud engineering teams.

7. Vulnerability Management

- Lead vulnerability management lifecycle including scanning, validation, prioritization, remediation tracking, exception handling, and reporting.
- Work with tools such as Qualys, Nessus, Rapid7, Tenable, or similar platforms.
- Prioritize vulnerabilities based on CVSS, asset criticality, exploitability, internet exposure,



business impact, and regulatory requirements.
- Track remediation SLAs and coordinate with infrastructure, application, and business teams for closure.
- Support patch governance and compensating control recommendations.
- Prepare vulnerability dashboards and aging reports for management review.

8. Identity and Access Security

- Monitor and strengthen identity security controls including MFA, privileged access, conditional access, risky login detection, and account compromise monitoring.
- Investigate impossible travel, brute-force login attempts, privilege escalation, suspicious account creation, and abnormal access patterns.
- Support periodic access reviews and privileged access governance.
- Work with IAM, PAM, Active Directory, Microsoft Entra ID / Azure AD, and related identity systems.

9. Email Security and Phishing Response

- Monitor and manage email security platforms such as Proofpoint, Cofense, Microsoft Defender for Office 365, Mimecast, or similar tools.
- Investigate phishing, spear phishing, BEC, malware attachments, credential harvesting, spoofing, and suspicious email campaigns.
- Analyze email headers, URLs, attachments, sender reputation, SPF, DKIM, and DMARC alignment.
- Coordinate takedown/blocking of malicious domains, URLs, senders, and attachments.
- Conduct enterprise-wide search and cleanup for malicious emails.

10. DevSecOps and Application Security Support

- Support secure software delivery by working with engineering and DevOps teams.
- Assist in implementing SAST, DAST, SCA, secret scanning, container image scanning, and CI/CD security gates.
- Review application and infrastructure vulnerabilities and recommend remediation actions.
- Support secure coding awareness, dependency risk management, and application security governance.

11. Security Audits, Compliance and Governance

- Support internal and external audits related to security controls, SOC operations, vulnerability management, incident response, and compliance.
- Work with frameworks and standards such as ISO 27001, NIST Cybersecurity Framework, CIS Controls, PCI-DSS, SOC 2, and other applicable regulations.
- Maintain evidence, reports, SOPs, runbooks, risk registers, exception records, and audit closure documents.
- Help define and track security KPIs including MTTD, MTTR, SLA adherence, vulnerability aging, false-positive rate, detection coverage, incident recurrence, and audit closure rate.

12. Team Collaboration and Mentoring

- Mentor junior security analysts and engineers.
- Review investigation quality and provide guidance on incident handling, RCA, threat analysis, and documentation.
- Conduct security awareness sessions and technical knowledge-sharing sessions.
- Work closely with IT, infrastructure, cloud, application, DevOps, compliance, and business teams.
- Participate in shift handovers, incident reviews, governance meetings, and security improvement initiatives.

📌 Senior Cyber Security Engineer (Mumbai)
🏢 Decimal Point Analytics
📍 Mumbai