Responsibilities

Note

- Lead complex security incident investigations and provide expert-level forensics and technical analysis.
- Perform end to end incident management, including containment, eradication, recovery, and root-cause analysis.
- Act as a senior escalation point for L1/L2 analysts and guide them through complex investigations.
- Conduct proactive, intelligence-driven threat hunting to identify advanced and stealthy threats.
- Analyse multi-source security logs, correlate events, and detect sophisticated attack patterns.
- Investigate zero day vulnerabilities, newly reported CVEs, and emerging cyber threats.
- Develop, refine, and maintain detection use cases, correlation rules, event logic, and alert thresholds.
- Provide SIEM SOAR tuning and optimization to reduce false positives and improve detection fidelity.
- Enhance automation workflows within SOAR platforms to improve incident response efficiency.
- Maintain and continuously improve SOC playbooks, SOPs, and response templates.
- Drive improvements across SOC processes, SLAs, shift workflows, and operational maturity.
- Lead continuous improvement initiatives, focusing on detection gaps, tuning feedback loops, and new log onboarding.
- Lead technical implementation and onboarding of new security tools, log sources, and integrations.
- Coordinate with platform teams to deploy, configure, and validate new security technologies.
- Oversee SIEM architecture enhancements, parser development, log ingestion, and normalization.
- Participate in deployment of EDR, UEBA, SOAR, Threat Intel, Network Security and other security platforms.
- Ensure successful end-to-end implementation: requirement gathering configuration testing go live.
- Drive continuous platform upgrades, configuration finetuning,



and operational improvements.
- Strong understanding of cyberattacks, threat vectors, MITRE ATTCK techniques, malware behaviour, and incident response frameworks.
- Expertise across Windows, Linux, and Unix environments.
- Strong knowledge of TCP/IP, DNS, DHCP, routing, packet analysis, and network security architecture.
- Hands-on experience with: SIEM (Splunk, QRadar, CrowdStrike etc.).
- IDS/IPS, UEBA, EDR, SSL inspection, Packet analysis tools.
- CrowdStrike Falcon (deep experience in policies, detection tuning, RTR, investigation).
- SOAR platforms (automation playbooks, workflow creation, integration).
- Ticketing systems such as JIRA, ServiceNow.
- Strong expertise in Vulnerability Management, VAPT, and scanning activities (tools and remediation workflows).
- Mentor, guide, and train L1 and L2 analysts on incident handling, detection techniques, and SOC maturity.
- Collaborate with cross-functional teams (Infra, IT, Cloud, Network, Risk, Application teams).
- Provide technical recommendations for remediation, risk reduction, and improved security posture.
- Create and deliver clear, actionable incident reports, executive summaries, and technical documentation.
- Monitor, assess, and respond to high severity alerts in a 24/7 SOC environment.
- Perform ongoing threat analysis, vulnerability assessment, and incident trend analysis.
- Participate in tabletop exercises,



after-action reviews, and cyber readiness activities.
- Handle and support any additional SOC responsibilities as assigned.

Requirements
- Experience - Overall 10 years of total experience, with 7-8 years of specialized expertise in Cybersecurity.
- Minimum 5 years of hands-on experience in a Security Operations Center (SOC) environment.

Physical Demands

Physical Demands:

Note: Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions as described. Regular eye-hand coordination and manual dexterity is required to operate office equipment. The ability to perform work at a computer terminal for 6-8 hours a day and function in an setting with constant interruptions is required.

At times, Team Members are subject to sitting for prolonged periods. Infrequently, Team Member must be able to lift and move material weighing up to 20 lbs. Team Member may experience elevated levels of stress during periods of increased activity and with work entailing multiple deadlines.

A is only intended as a guideline and is only part of the Team Member s function. The company has reviewed this to ensure that the essential functions and basic duties have been included. It is not intended to be construed as an exhaustive list of all functions, responsibilities, skills and abilities. Additional functions and requirements may be assigned by supervisors as deemed appropriate.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 DM - Security (Chennai)
🏢 CorroHealth
📍 Chennai