About pharma&

pharma& is a privately owned global pharmaceutical company headquartered in Vienna, Austria. We focus on breathing new life into proven medicines, preserving their availability, and ensuring essential treatments reach patients worldwide. With a growing portfolio across hematology, oncology, and other therapeutic areas, we operate through a global network of subsidiaries, joint ventures, and partners to support development, manufacturing, and access.

About the roleWe are looking for a hands-on Security Operations Analyst to join our Global Capability Centre in Hyderabad and support security operations across pharma& and its group companies, including LOBA.

You will investigate security incidents, maintain effective Microsoft Defender controls and work with IT colleagues to address vulnerabilities and reduce risk. Microsoft Defender and Microsoft 365 will be central to your work, alongside security issues identified through employee reports, other systems and external assessments.

Working with Group IT, local IT teams and specialist security partners, you will take responsibility for progressing investigations and remediation actions—not simply identifying issues and passing them on.

This is a technical, individual-contributor role suited to someone with around five years of relevant experience who can work independently, exercise sound judgement and communicate clearly with both technical and non-technical colleagues.

Key responsibilities

- Investigate and respond to security incidents. Monitor and triage Microsoft Defender XDR alerts, investigate activity across endpoints, email and identities, and carry out or coordinate containment and remediation under agreed response procedures. Escalate significant incidents promptly.
- Manage email threats and employee-reported concerns. Investigate suspicious emails, calls, messages and account activity. Take appropriate action, including removing malicious emails and managing approved blocking rules and exceptions.
- Maintain effective Defender protection. Configure and maintain Defender for Endpoint and Defender for Office 365 policies. Work with IT colleagues on device onboarding, sensor health, protection coverage and policy tuning.





- Perform deeper investigations and threat hunting. Use Defender advanced hunting, KQL and relevant logs to investigate suspicious activity, identify related events and improve detection quality.
- Drive vulnerability remediation through to completion. Review findings from Defender, authorised scans and external assessments. Prioritise them by risk and business impact, agree actions and target dates with owners, track progress, verify completion and escalate overdue high-risk items.
- Support identity and access security. Work with Microsoft 365 and Entra ID administrators to investigate suspicious sign-ins and review authentication controls, privileged access and third-party access.
- Coordinate authorised website security scanning. Run or coordinate scans within an agreed scope, assess the findings and work with website owners, developers and suppliers on remediation and retesting. Support specialist testing where required.
- Work safely across corporate and site environments. Coordinate security actions with infrastructure teams, local IT and suppliers, following approved change-control and escalation procedures, particularly for business-critical and manufacturing-related systems.
- Build security awareness. Plan phishing simulations, review results and deliver practical training and communications that help colleagues recognise and report threats.
- Maintain documentation and report progress. Keep clear incident records, investigation evidence and response procedures.

Contribute to security policies and audit requests, and report on incidents, protection coverage, outstanding vulnerabilities and remediation progress.

What we are looking for
- Around five years of relevant experience in information security or IT,



including substantial hands-on responsibility for security operations.
- Strong practical experience with Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365 and Defender vulnerability-management capabilities.
- Experience investigating phishing, account compromise and endpoint threats, and coordinating vulnerability remediation.
- Working knowledge of Microsoft 365, Exchange Online, Entra ID and Intune, supported by a good understanding of Windows environments and networking fundamentals.
- Ability to use KQL and security logs to investigate activity, interpret evidence and document findings.
- Clear written and spoken English, good prioritisation skills and the confidence to work with colleagues and suppliers across different countries and time zones.
- A degree in Computer Science, Information Systems, Cybersecurity or a related field, or equivalent practical experience.

Additional experience that would be usefulMicrosoft Certified: Security Operations Analyst Associate (SC-200), or another relevant security certification, would be an advantage.

We would also welcome experience with Microsoft Sentinel, Defender for Identity, Microsoft Purview or security automation; website vulnerability scanning; phishing simulations; or security work in a pharmaceutical, manufacturing or other regulated environment.

You do not need experience in every additional area to apply. Strong practical Microsoft security skills and the ability to take responsibility for your work are our priorities.

Why join us?You will have the opportunity to take ownership of meaningful security work within an international pharmaceutical business. Based in our Hyderabad GCC, you will work closely with colleagues across the organisation, contribute to practical security improvements and help develop our security operations capability.

Working arrangementsThis is an office-based role in Hyderabad. Applicants should already be based locally or be willing to relocate. Working hours are 11:00 am–8:00 pm IST.

The role involves access to sensitive information and requires discretion, skilled integrity and adherence to company security and confidentiality policies.

📌 Security Operations Analyst – Microsoft Defender & Microsoft 365 (Hyderabad)
🏢 pharmau0026
📍 Hyderabad