Job Description

SOC Principal

n

HCL Software | Office of the CISO

n

Location: India - Bangalore / Noida / Remote

n

About the Role

n

HCL Software is seeking a SOC Principal to serve as the most senior technical authority inside our

n

Security Operations Center. This is a hands-on individual contributor role for someone who wants

n

depth and influence rather than a management span, and it sits at the point where detection quality,

n

investigation rigor, and incident command all converge.

n

You will set the technical bar for how the SOC detects, investigates, and closes out threats across a

n

global multi-cloud and SaaS estate, while our detection platform modernizes and our telemetry

n

pipeline is rebuilt.

n

You will work alongside SOC Engineering, Vulnerability Management, Red Team, and Product

n

Security, and you will be the person the organization escalates to when an incident is genuinely

n

ambiguous.

n

Key Responsibilities

n

Investigation and Incident Response

n

• Act as a technical incident commander for severity-1 and severity-2 events, coordinating across

n

IT, engineering, legal, communications, and customer-facing teams.

n

• Own the deep-dive analysis that junior tiers cannot complete: host and memory forensics,

n

cloud control-plane reconstruction, identity abuse chains, and lateral movement tracing.

n

• Drive root cause to conclusion and convert every significant incident into concrete detection,

n

control, and process changes with named owners.

n

• Set and enforce evidence handling, chain of custody, and case documentation standards

n

suitable for customer, regulator, and audit scrutiny.

n

Detection and Content Engineering

n

• Define detection content standards covering test coverage, version control, peer review, and

n

promotion through a detection-as-code pipeline.

n

• Maintain an ATT&CK-aligned; coverage map, identify blind spots, and prioritize current content

n

against threat intelligence and business risk.

n





• Govern tuning and suppression decisions so false-positive reduction never quietly removes real

n

visibility.

n

• Partner with SOC Engineering on telemetry sufficiency, parsing quality, and log source

n

onboarding during platform migration.

n

Threat Hunting and Intelligence

n

• Build and run a recurring hunt program driven by hypotheses, threat intelligence, and observed

n

adversary tradecraft relevant to enterprise software companies.

n

• Operationalize intelligence into detections, hunt queries, and watchlists rather than leaving it as

n

reading material.

n

• Collaborate with Red Team on purple-team exercises and validate that emulated tradecraft is

n

actually detected.

n

Technical Leadership

n

• Mentor analysts across shifts, run investigation retrospectives, and raise consistency in triage

n

and escalation decisions.

n

• Author and maintain the runbook and playbook library, keeping it accurate as the platform

n

estate changes.

n

• Represent the SOC in design discussions with architecture, cloud, and product engineering

n

teams.

n

• Produce clear written analysis for leadership that separates what is known, what is suspected,

n

and what is still open.

n

Required AI Expertise

n

• Hands-on experience implementing and evaluating AI-driven security automation, automated

n

triage, and generative AI investigation workflows within a modern SOC environment.

n

• Strong understanding of threat landscapes targeting AI/ML systems, including prompt injection,

n

model poisoning, data exfiltration via LLMs, MCP, and securing enterprise AI infrastructure.

n





• Ability to design detection strategies for AI-assisted attack vectors and adversary tradecraft

n

leveraging autonomous or AI-enhanced tools.

n

Required Qualifications

n

• 8+ years in security operations, incident response, or threat detection, including senior or lead

n

responsibility for major incidents.

n

• Demonstrated incident command experience on severity-1 events, with the judgment to make

n

containment calls under incomplete information.

n

• Deep hands-on expertise with SIEM platforms and detection content development, including

n

query languages, correlation logic, and detection tuning.

n

• Strong working knowledge of EDR telemetry, identity and SSO attack patterns, and cloud

n

security operations across AWS, Azure, or GCP.

n

• Fluency with MITRE ATT&CK; as an operational tool rather than a slide, including coverage

n

mapping and gap analysis.

n

• Practical scripting and automation ability (Python, PowerShell, or equivalent) for enrichment,

n

analysis, and tooling.

n

• Excellent written communication, including the ability to produce incident narratives that hold up

n

in front of executives, customers, and auditors.

n

Preferred Qualifications

n

• Experience through a SIEM platform migration, including detection content translation,

n

parallel-run validation, and log pipeline rework.

n

n
- Experience with leading technologies (Wiz, Crowdstrike
n
- Background in a software or product company, with an understanding of how enterprise SOC
n

n

work connects to customer trust and product security.

n

• Familiarity with detection-as-code practices, CI/CD for content, and automated detection

n

testing.

n

n
- Experience investigating attacks against SaaS, CI/CD, and software supply chain targets.
n
- Exposure to AI-assisted triage and investigation workflows, with a considered view of where
n

n

human judgment remains mandatory.

n

• Certifications valued but not required: GCIA, GCIH, GCFA, GNFA, GDAT, or equivalent.

📌 SOC Principal (Bengaluru)
🏢 HCLSoftware
📍 Bengaluru