JD - Cloud Security Engineer - Incident Response Threat Detection

Position: Cloud Security Engineer (Incident Response Threat Detection)

Location: Bangalore

Employment Type: Full Time

About the Role

We are looking for a hands-on Cloud Security Engineer to join our security operations team. This is an implementation-focused role where you will execute security controls, monitor cloud environments, and manage incident response activities. You will be responsible for implementing security controls, maintaining visibility across our multi-cloud infrastructure, integrating log sources into our NG-SIEM, and supporting threat detection and incident response.

You will work with platform, DevOps, and product engineering teams to implement and maintain security standards across our cloud environments.

What You Will Do

Incident Response Threat Detection

- Manage incident response activities: triage alerts, investigate incidents, and assist in containment and eradication
- Monitor NG-SIEM dashboards and alert systems, investigating suspicious activities and escalating findings
- Collect and preserve forensic evidence during security incidents
- Document incident timelines and findings for post-incident reviews
- Conduct threat hunting based on threat intelligence and anomaly detection patterns

Cloud Security Operations:
- Implement cloud security controls as defined by management across AWS, Azure, and GCP environments
- Monitor cloud infrastructure for misconfigurations, compliance violations, and security drift
- Perform periodic checks on implemented security controls to ensure they remain effective
- Review IAM policies, security groups, network ACLs, and cloud logging configurations for alignment with security standards
- Maintain documentation on deployed controls and their operational status
- Manage CNAPP and NG-SIEM integrations across cloud accounts

NG-SIEM Operations Log Integration:
- Integrate log sources from cloud platforms, firewalls, and security tools into the NG-SIEM platform
- Configure log parsers,



correlation rules, and dashboards for effective threat detection
- Monitor NG-SIEM performance and optimize log ingestion and processing
- Troubleshoot log integration issues and ensure continuous data flow from all sources
- Review NG-SIEM alerts and detected threats, investigating and escalating as needed

Cloud Security Monitoring:
- Monitor NG-SIEM platforms for threat detection and incident signals
- Review security alerts and logs to identify suspicious patterns or policy violations
- Generate periodic security reports on cloud posture, incidents, and monitoring effectiveness
- Share findings and recommendations with management

General:
- Maintain security playbooks and runbooks for implemented controls
- Assist in onboarding current cloud accounts into security monitoring and protection tools
- Ensure implemented controls meet compliance requirements and internal security policies
- Participate in security training and stay current with cloud security best practices

What You Bring
- 5-9 years of hands-on experience in cloud security, SOC operations, incident response, or related cybersecurity discipline
- Practical knowledge of at least one major cloud provider (AWS preferred), including IAM, security groups, VPCs, and logging
- Strong experience monitoring security alerts and responding to incidents in a SIEM or NG-SIEM environment
- Proven experience investigating real-world security incidents and assisting in incident containment
- Strong understanding of threat detection concepts and NG-SIEM operation
- Understanding of threat modeling frameworks (STRIDE, PASTA) and how security controls map to threats




- Familiarity with next-generation firewalls and web application firewalls at a functional level (how they work, architecture)
- Familiarity with security frameworks (NIST, CIS, ISO 27001)
- Strong analytical and problem-solving skills with ability to investigate security findings and escalate appropriately
- Clear communication skills, able to document findings and prepare reports for management
- AWS Security Fundamentals, Azure Security Engineer Associate, CEH, or ECIH certification is advantageous

Good to Have
- Experience with scripting in Python, Bash, or similar for security operations and automation
- Familiarity with container security concepts (ECS, EKS, Docker)
- Experience working in a cloud security operations or platform security environment
- Understanding of Zero Trust Architecture principles
- Knowledge of incident response workflows and forensic investigation techniques
- Experience integrating multiple log sources into a centralized SIEM or NG-SIEM platform

Why Choose Trianz Personal Growth: Work on cloud security for global enterprises across financial services, healthcare, manufacturing, and hi-tech sectors.

Multi-Cloud Expertise: Hands-on experience across AWS, Azure, and GCP security operations.

Incident Response: Manage real-world incident response activities and threat detection at scale.

Ownership Impact: Own the implementation and monitoring of security controls that protect enterprise infrastructure.

Global Impact: Support transformations across multiple continents with diverse teams and enterprise clients.

NG-SIEM Threat Detection: Work with modern threat detection platforms and manage security monitoring across multi-cloud environments.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Sr Technical Lead (Bengaluru)
🏢 Trianz
📍 Bengaluru