SecOps Engineer

Experience: 5+ years in security operations

You will own detection, incident response and day-to-day hardening across our production and corporate environments. The role suits someone who has handled real incidents end to end and wants to reduce how often they happen.

Responsibilities

- Monitor, triage and investigate alerts from SIEM, EDR, cloud and network sources.
- Own incidents from detection through containment, eradication, recovery and post-incident review.
- Build and tune detection rules and correlation searches to raise signal and cut false positives.
- Write and maintain incident response runbooks, and automate repeat response steps with SOAR or scripts.
- Run vulnerability management: scan, prioritise by risk, and track remediation with engineering teams to agreed SLAs.
- Harden cloud, Kubernetes, CI/CD and endpoint configurations against CIS benchmarks.
- Run threat hunts based on MITRE ATT&CK; techniques and current threat intelligence.
- Keep log coverage, retention and integrity adequate for investigation and audit.
- Provide evidence and control walkthroughs for ISO 27001 and SOC 2 audits.
- Take part in the on-call rotation for security incidents.

Required skills
- 5+ years in a SOC, incident response or security operations role,



with hands-on ownership of incidents.
- SIEM query and detection writing in at least one of Splunk, Microsoft Sentinel, Elastic Security or Wazuh.
- EDR or XDR operation, such as CrowdStrike, Microsoft Defender or SentinelOne.
- Cloud security monitoring on AWS or Azure: IAM, CloudTrail, GuardDuty, Security Hub or their equivalents.
- Strong Linux and networking fundamentals: TCP/IP, DNS, TLS, proxies and firewalls.
- Working knowledge of containers and Kubernetes from a security and logging standpoint.
- Scripting in Python, Bash or PowerShell for automation and log analysis.
- Vulnerability scanning with tools such as Nessus, Qualys or Trivy.
- Familiarity with MITRE ATT&CK; and the NIST incident response lifecycle.
- Clear written communication for incident reports and root-cause analyses.

Valuable to have
- SOAR platform experience, such as Cortex XSOAR, Splunk SOAR or Tines.
- Digital forensics and malware triage skills.
- Detection-as-code practice using Sigma rules and Git-based workflows.
- Certifications: GCIH, GCIA, CySA+, AWS Security Specialty or CEH.

Pay: ₹329,000.00 - ₹1,430,000.00 per year

Work Location: In person

📌 SecOps Engineer (Guindy)
🏢 Regent Campus D2
📍 Guindy