: Security Analyst – Endpoint Security, SIEM & Vulnerability Management

Location: Pune/Noida/Bangalore, India

Experience 2–5 years

Department IT Infrastructure & Information Security

Employment Full-time

About Onextel

Onextel Limited delivers enterprise communication technology and CPaaS solutions including SMS, WhatsApp Business API, Voice, RCS, Email and telecom messaging infrastructure to enterprises, financial institutions and government organizations.

Role Overview

We seek a hands-on Security Analyst to monitor and strengthen cybersecurity across enterprise endpoints, Windows/Linux servers, virtualized infrastructure and networks. The role covers SIEM monitoring, EDR/XDR investigation, vulnerability tracking, incident response and remediation coordination, working closely with Infrastructure, Network and Development teams.

Key Responsibilities

Security Monitoring & SIEM Operations

- Monitor events using Microsoft Sentinel, Wazuh, ELK Stack, Splunk or equivalent SIEM platforms.
- Analyze and correlate Windows, Linux, endpoint, firewall and network logs; investigate suspicious activity and unauthorized access.
- Develop and tune detection queries and rules (including KQL), reduce false positives and maintain dashboards.

Endpoint Detection & Response
- Monitor, configure and administer EDR/XDR and antivirus solutions such as Microsoft Defender XDR or CrowdStrike.
- Investigate malware, phishing, suspicious processes, ransomware indicators and endpoint compromises.
- Monitor agent health, coverage and updates; troubleshoot agents and coordinate isolation, containment and recovery.

Vulnerability & Patch Management
- Identify and track CVEs, missing patches, insecure configurations and vulnerabilities using Qualys, Nessus, OpenVAS or equivalent tools.
- Prioritize findings by CVSS, exploitability and asset criticality; coordinate remediation and validate closure.
- Maintain vulnerability registers,



patch compliance dashboards and remediation reports.

Security Incident Response & Investigation
- Triage and investigate brute-force attempts, unauthorized access, malware and suspicious authentication events.
- Analyze email headers, IPs, domains and IOCs using VirusTotal, AlienVault OTX, MISP and other intelligence sources.
- Apply MITRE ATT&CK; and Cyber Kill Chain concepts; document incident classification, escalation, RCA and closure.

Linux, Windows & Infrastructure Security
- Analyze operating-system authentication logs, processes, access controls, ports and network connections.
- Support Linux/Windows hardening, CIS baseline reviews, server security and virtualized infrastructure security.
- Coordinate remediation of insecure services, outdated packages and unauthorized changes.

Network & Firewall Security
- Review firewall, VPN, IDS/IPS and network logs for scanning, malicious traffic and unauthorized connections.
- Use TCP/IP, DNS, DHCP, SSH and HTTP/HTTPS fundamentals to investigate incidents.
- Coordinate firewall rule reviews, malicious-IP blocking and network containment with administrators.

Threat Intelligence & Automation
- Perform IOC enrichment, basic threat hunting and threat-intelligence monitoring.
- Use Python, PowerShell or Bash to automate log analysis, checks, alert triage and reporting.

Reporting, Compliance & Governance
- Prepare daily monitoring summaries and weekly/monthly security posture reports.
- Maintain incident records, vulnerability trackers, SOPs and escalation workflows.
- Support ISO 27001 controls, audit evidence,



security policy compliance and corrective-action tracking.

Required Technical Skills
- SIEM: Microsoft Sentinel, Wazuh, ELK Stack, Splunk or equivalent; KQL, log correlation
- Endpoint: Microsoft Defender XDR, CrowdStrike or equivalent EDR/XDR; endpoint security
- Operating systems: Windows, Windows Server, Linux/Ubuntu; security log and process analysis
- Incident response: Alert triage, phishing/malware investigation, escalation, containment and RCA
- Vulnerabilities: CVE/CVSS, vulnerability scanning, patch management and remediation tracking
- Networking: TCP/IP, DNS, DHCP, SSH, VPN and firewall fundamentals
- Threat intelligence: MITRE ATT&CK;, IOCs, VirusTotal, MISP or equivalent
- Automation: Python, PowerShell or Bash

Valuable-to-Have Skills
- DLP and MDM/UEM
- Netskope CASB/SWG
- Fortinet firewalls
- Proxmox virtualization
- CIS hardening
- IDS/IPS
- Zero Trust
- SOAR
- ISO 27001

Qualifications & Certifications
- Bachelor’s degree in Computer Science, IT, Electronics, Cybersecurity or a related discipline
- Minimum 2 years of relevant cybersecurity or infrastructure security experience.
- Preferred (not mandatory): Microsoft SC-200, CompTIA Security+/CySA+, Splunk, Qualys, Cisco cybersecurity or CEH certifications.

Key Performance Indicators
- Endpoint and server security monitoring coverage and agent health.
- Timely identification, investigation and escalation of security alerts.
- Accuracy and completeness of incident investigations and documentation.
- Vulnerability and patch remediation tracking against agreed SLAs.
- Quality of security reports, detection tuning and operational improvements.

Candidate Profile A proactive analyst with practical SIEM, EDR, Windows/Linux log analysis, vulnerability management and investigation experience. Willingness to build further hands-on capability in enterprise DLP, MDM and security platform administration is desirable.

📌 Security Analyst (Pune)
🏢 OneXtel
📍 Pune