Job Summary

Working within eBay's Computer Security Incident Response Team (CSIRT) Operations team, you will play a critical role in protecting eBay's information assets by monitoring, investigating, and responding to cybersecurity events. As a member of the CSIRT Ops team, you will help identify potential threats, perform alert triage, phishing triage, respond to enquiries to CSIRT, escalate potential incidents to the Incident Response team.

You'll work in a fast-paced, highly collaborative setting where you'll contribute to the continuous monitoring, triage of the threats and malicious actions and help defend one of the world's largest e-commerce platforms.

Responsibilities

- Security Monitoring - Monitor global security events and alerts across enterprise security platforms in a 24x7 operational environment. Identify, classify, and prioritize security events for investigation.
- Incident Response - Perform initial investigation, triage, and analysis of security events. Support incident response activities by documenting findings, participating in investigation calls, and escalating incidents that require additional expertise in accordance with established procedures.
- Containment & Investigation - Execute approved containment actions to limit the impact of security incidents and assist with forensic preservation and investigation activities while maintaining appropriate chain of custody.
- Threat Detection - Analyze security alerts, identify indicators of compromise (IOCs), and recommend improvements to detection content and alert tuning to improve monitoring effectiveness and reduce false positives.
- Threat Intelligence - Collect, analyze, and disseminate relevant open-source intelligence (OSINT) to support investigations and improve situational awareness.
- Technology Improvement - Participate in the testing, evaluation, implementation,



and continuous improvement of security technologies, detection capabilities, and operational processes.
- Escalations - Perform timely verbal and documented escalations to Detection & Response Engineers and on-call personnel when incidents require advanced investigation or exceed established response thresholds.
- Coverage - Participate in a rotating 24x7 shift schedule, including weekends and holidays, as required to support continuous global security operations.

To be successful in this position, you should be familiar with:

Requirements

- Security Operations - Security event monitoring, alert triage, incident classification, and response workflows within a Security Operations Center (SOC) or CSIRT environment.
- Incident Response - Security investigation methodologies, containment techniques, evidence preservation, and incident documentation.
- Threat Detection - Experience working with Security Information and Event Management (SIEM) platforms to investigate alerts, analyze logs, and identify malicious activity.
- Endpoint & System Security - Understanding of Windows, Linux, and endpoint security concepts, including basic forensic acquisition and investigation techniques.
- Networking Fundamentals - Knowledge of TCP/IP networking protocols including HTTP, DNS, FTP, DHCP, ARP, and experience using network analysis tools such as Wireshark or tcpdump.
- Threat Intelligence - Familiarity with indicators of compromise (IOCs), MITRE ATT&CK;,



and open-source intelligence (OSINT) techniques.
- Scripting & Automation - Experience with Python or a similar scripting language to automate repetitive operational tasks and improve investigation efficiency.
- Security Technologies - Experience with endpoint detection and response (EDR), SIEM platforms, and other enterprise security monitoring tools.

Qualifications

- Bachelors degree in Computer Science, Engineering, Information Technology, Cybersecurity, or a related field, or equivalent practical experience.
- Minimum of three (3) years of professional experience in Security Operations, Security Incident Response, Threat Detection, Digital Forensics, or a related cybersecurity discipline.
- Experience investigating security events and responding to cybersecurity incidents in an enterprise environment.
- Experience working with SIEM, EDR, or other enterprise security monitoring technologies.

Must have at least one of the following certifications

- SANS GIAC (GCIA, GCIH, GCED, GCFA, GCFE, GMON, GNFA, GREM, or equivalent)
- ISC2 (cissp, CCSP)
- CompTIA Security+
- Cisco (CCNA, CCNP)
- EC-Council (CEH, ECIH, CHFI)
- Offensive Security (OSCP)

In addition, a minimum of three (3) years of specialised experience in one or more of the following areas

- Security Operations Center (SOC) or Computer Security Incident Response Team (CSIRT)
- Security Incident Response and Investigation
- Threat Detection and Monitoring
- Digital Forensics and Evidence Preservation
- Cyber Threat Intelligence

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Security Operations Engineer (Bengaluru)
🏢 The Networker
📍 Bengaluru