REQUIREMENT

- 7+ years of hands-on SOC/cybersecurity experience.
- Strong experience with Microsoft Sentinel and KQL.
- Hands-on experience with Microsoft Defender for Endpoint and/or equivalent EDR.
- Experience with Microsoft Defender for Cloud or equivalent cloud security platforms.
- Strong understanding of Microsoft Entra ID / Active Directory security.
- Practical security monitoring/investigation experience in Azure and AWS.
- Strong experience in incident response and security investigations.
- Proven experience conducting post-incident/root-cause investigations and postmortems.
- Strong understanding of Windows/Linux, networking, authentication, IAM, endpoint, and cloud security.
- Ability to correlate and investigate large volumes of security logs and identify genuine threats from false positives.
- Experience with MITRE ATT&CK; and threat-hunting methodologies.

PREFERRED
- Experience with Splunk/SPL, Wazuh, Elastic, or other SIEM platforms.
- Experience with Bitdefender or other enterprise EDR/XDR platforms.
- PowerShell, Python, Bash, or REST API automation experience.
- Experience with Sentinel automation/SOAR.
- Relevant certifications such as SC-200, AZ-500, GCIH, GCFA, CySA+, Security+, or CISSP.

- Configure, monitor, tune, and maintain Microsoft Sentinel, including analytics rules, alerts, dashboards, and detection use cases.
- Develop and use KQL for security investigations, threat hunting, log correlation, and detection engineering.




- Monitor and investigate alerts from Microsoft Defender for Endpoint, Defender for Cloud, Bitdefender, and other security platforms.
- Monitor and investigate Microsoft Entra ID authentication, privileged access, suspicious sign-ins, compromised accounts, and identity-related threats.
- Investigate security events across Azure and AWS, including cloud audit logs, IAM activity, API activity, configuration changes, and suspicious cloud activity.
- Correlate endpoint + identity + cloud + network + application logs to determine attack scope, timeline, and impact.
- Lead/participate in incident response including triage, containment, eradication, recovery, and escalation.
- Conduct root-cause analysis, forensic investigation, and security postmortems following incidents.
- Identify detection/control gaps and convert incident findings into improved SIEM rules, monitoring, and security controls.
- Perform proactive threat hunting and map relevant activity to MITRE ATT&CK.;
- Maintain SOC runbooks, incident-response playbooks, and investigation procedures. Support a globally distributed setting, including rotational/on-call incident response when required.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Sr SOC ANALYST - CYBER SECURITY (Chennai)
🏢 MAJULAH INFOTECH
📍 Chennai