Job DescriptionKey Responsibilities
n1. Monitoring & Offense Management
n
- n
- Monitor security events and alerts through QRadar dashboards, consoles, and offense queues.n
- Conduct initial and detailed investigation of offenses, determine true/false positives, and escalate as required.n
- Perform log enrichment, event correlation analysis, and offense deep‐dive using QRadar tools.n

n2. Investigation & Incident Response
n
- n
- Investigate suspicious activities (credential misuse, lateral movement, DNS anomalies, exfiltration, malware behavior).n
- Perform root‐cause analysis (RCA) for confirmed incidents.n
- Document incident timelines, artifacts, and technical findings in SOC case management tools.n
- Coordinate containment, eradication, and recovery steps with relevant teams.n

n3. AQL Search & Log Analysis
n
- n
- Use AQL (Ariel Query Language) for advanced searches, pivoting, and correlation.n
- Analyze logs from Windows/Linux servers, network devices, EDR, cloud services, and applications.n




- Build actionable dashboards and custom queries to support threat‐hunting and investigations.n

n4. Use Case Management & Rule Tuning
n
- n
- Review and tune QRadar correlation rules, building blocks, reference sets, and threat models.n
- Optimize detection rules to reduce false positives and improve alert fidelity.n
- Work with Threat Intelligence team to integrate IOCs, threat feeds, and enrichment sources.n

n5. Threat Hunting
n
- n
- Conduct proactive hunts using QRadar events, anomalies, traffic patterns, and baselines.n
- Look for MITRE ATT&CK; TTPs such as privilege escalation, persistence, lateral movement, and command‐and‐control communication.n
- Document hunt hypotheses, results, and recommended improvements.n

n6. QRadar Administration Support (as needed)
n
- n
- Validate log source onboarding and troubleshoot ingestion issues.n
- Ensure log sources are normalized, parsed correctly, and categorized appropriately.n
- Particip

📌 MDR - Delhi DL
🏢 Tata Consultancy Services
📍 Delhi