At Risknox, we're building out our Security Operations Centre in Mumbai, and we're looking for an analyst who wants to do more than watch alerts.
In this role you'll monitor and respond to real threats for our clients. You'll also help configure the SOC from the ground up, and work directly with our product team to improve Pulse, our SIEM and EDR platform. Your detections and fixes will ship in the product.
What you'll do
→ Triage, investigate and respond to alerts across endpoints, firewalls, servers and cloud
→ Contain incidents using EDR and escalate as per playbooks
→ Write and tune detection rules, dashboards and playbooks mapped to MITRE ATT&CK;
→ Automate enrichment and response with Python, PowerShell or Bash
→ Shape Pulse by testing releases and turning analyst pain points into features
What we're looking for
✔ 2–3 years in a SOC, MSSP or security monitoring role
✔ Hands-on with a SIEM (Wazuh, Elastic,
Splunk, Sentinel, QRadar or similar) and an EDR/XDR tool
✔ Has configured log sources, parsers or detection rules, not just consumed alerts
✔ Strong grasp of Windows, Linux, Active Directory and network fundamentals
✔ Scripting skills and clear written communication
✔ Based in Mumbai or willing to relocate; open to rotational shifts
Valuable to have: Wazuh/Sigma/MISP experience; familiarity with CERT-In reporting and the DPDP Act
Why Risknox
- A real say in how a SOC and its platform get built
- A clear growth path towards L3, detection engineering or threat hunting
- exposure to clients across India and the GCC
- An award-winning team (Best Innovative Cybersecurity Solution, GISEC Global 2025)