Onsite- Job location- Kurla, Mumbai

Be the internal owner of detection, vulnerability management, and threat intelligence — the connective tissue between our tooling (Qualys, Palo Alto SIEM/XDR, Cloud SEK) and our outsourced MDR partner. You'll make sure alerts and findings actually get triaged and acted on, and you'll be the coordination point for red team and purple team exercises that test whether our detection stack really works.

What you'll own:

- Qualys (vulnerability management) — scan scheduling, triage, severity scoring, remediation SLA tracking
- Palo Alto SIEM/XDR — internal liaison and escalation point for the MDR partner's 24/7 monitoring
- Cloud SEK — triage of external threat intel alerts (leaked credentials, brand impersonation, exposed assets) and routing to the right owners

Key responsibilities:

- Own the MDR partner relationship day-to-day: escalation path, alert quality, and detection tuning feedback loop
- Triage Qualys findings, route to engineering owners, and track remediation against SLA — automating ticket creation and routing where possible




- Ensure CloudSEK alerts have a explicit owner and don't become unread noise; work with MDR to ingest the feed into their triage queue where feasible
- Coordinate red team / purple team engagements jointly with the MDR partner, once MDR has been live at least one full quarter
- Support pen test remediation verification and technical evidence requests from auditors
- Build and maintain lightweight automation (auto-ticketing, severity-based routing, rescan-verified auto-close) in line with the team's lean, AI-driven model
- Flag detection or coverage gaps to the Security Lead, especially where they intersect with regulatory notification timelines

What we're looking for:

- 3–6+ years in security operations, detection engineering, or vulnerability management
- Hands-on experience with a SIEM/XDR platform (Palo Alto Cortex preferred) and a vulnerability scanner (Qualys preferred)
- Experience working with or managing an MDR/MSSP relationship, including holding a partner accountable to SLAs
- Comfortable owning a triage process end-to-end — not just running scans, but making sure findings get fixed
- Familiarity with coordinating external red team, purple team, or pen test engagements

📌 Cyber Security Engineer (Kurla)
🏢 Sourcebae
📍 Kurla