Job Description

Key Responsibilities

n
Monitoring & Offense Management

n

n
Monitor security events and alerts through QRadar dashboards, consoles, and offense queues.
n
Conduct initial and detailed investigation of offenses, determine true/false positives, and escalate as required.
n
Perform log enrichment, event correlation analysis, and offense deep‐dive using QRadar tools.
n

n
Investigation & Incident Response

n

n
Investigate suspicious activities (credential misuse, lateral movement, DNS anomalies, exfiltration, malware behavior).
n
Perform root‐cause analysis (RCA) for confirmed incidents.
n
Document incident timelines, artifacts, and technical findings in SOC case management tools.
n
Coordinate containment, eradication, and recovery steps with relevant teams.
n

n
AQL Search & Log Analysis

n

n
Use AQL (Ariel Query Language) for advanced searches, pivoting, and correlation.
n
Analyze logs from Windows/Linux servers, network devices, EDR, cloud services, and applications.
n
Build actionable dashboards and custom queries to support threat‐hunting and investigations.
n

n
Use Case Management & Rule Tuning

n

n
Review and tune QRadar correlation rules, building blocks,



reference sets, and threat models.
n
Optimize detection rules to reduce false positives and improve alert fidelity.
n
Work with Threat Intelligence team to integrate IOCs, threat feeds, and enrichment sources.
n

n
Threat Hunting

n

n
Conduct proactive hunts using QRadar events, anomalies, traffic patterns, and baselines.
n
Look for MITRE ATT&CK; TTPs such as privilege escalation, persistence, lateral movement, and command‐and‐control communication.
n
Document hunt hypotheses, results, and recommended improvements.
n

n
QRadar Administration Support (as needed)

n

n
Validate log source onboarding and troubleshoot ingestion issues.
n
Ensure log sources are normalized, parsed correctly, and categorized appropriately.
n
Participate in QRadar patching, upgrades, backup/restore tests, and HA validation (if required).
n

n
Reporting & Compliance

n

n
Generate daily, weekly, and monthly security reports.
n
Provide data for compliance audits (ISO 27001, PCI‐DSS, RBI, GDPR, internal governance).
n

n

Maintain all SOC documentation, SOPs, and detection playbooks.

📌 Mdr New Delhi
🏢 Tata Consultancy Services
📍 New Delhi