Role: L2 Security Specialist

Location:
Pune / Hyderabad Experience Level: 3 to 5 years Position Overview We are seeking an analytical and vigilant L2 Security Specialist to join the cybersecurity operations team supporting the Project. The infrastructure is a complex hybrid environment spanning native Microsoft Azure, Azure VMware Solution (AVS), and on-premises data centers. In this role, you will be the core technical guardian of the project’s security boundaries. You will secure workloads across public cloud, virtualized VMware software-defined data centers (SDDCs), and legacy physical hardware. Your mission is to implement zero-trust network configurations, manage hybrid identities, ensure strict vulnerability governance, and lead the technical response to security events across all environments.

Key Responsibilities
1. Hybrid Network Security & Micro-segmentation
• NSX-T & Cloud Firewalls: Manage and audit distributed firewall rules within VMware NSX-T for the Azure VMware Solution (AVS) cluster, as well as native Azure Network Security Groups (NSGs) and Application Security Groups (ASGs).
• Micro-segmentation Strategy: Define and implement granular micro-segmentation policies to isolate application workloads across native Azure, AVS guest environments, and on-premises physical servers.
• Cross-Boundary Encryption: Ensure all transit data moving over VPNs, ExpressRoute, and Azure Global Reach is securely encrypted using IPsec or TLS protocols. 2. Identity & Access Governance
• Hybrid Identity: Administer and monitor identity syncs and federations between Microsoft Entra ID (Azure AD)



and on-premises Active Directory Domain Services (AD DS).
• Access Control (RBAC): Enforce the principle of least privilege by configuring and maintaining Role-Based Access Control (RBAC) across Azure subscriptions, AVS vCenter instances, and on-premises virtualization hosts.
• MFA & Conditional Access: Implement and audit Conditional Access Policies, Multi-Factor Authentication (MFA), and Privileged Identity Management (PIM) for project personnel. 3. Vulnerability & Threat Management
• Vulnerability Scanning: Schedule and evaluate regular vulnerability scans across hybrid VM operating systems, containerized workloads, and hypervisor management interfaces using tools like Microsoft Defender for Cloud or Qualys.
• Patch Compliance Governance: Work closely with the DevOps and Infrastructure teams to track patch compliance and prioritize remediations for CVEs affecting virtual machines in Azure and AVS.
• Secrets Management: Securely manage certificates, connection strings, API keys, and cryptographic keys using Azure Key Vault and on-premises hardware security modules (HSMs). 4. Security Monitoring & Incident Response
• SIEM Management: Collect, analyze, and query security logs (using KQL) inside Azure Sentinel (SIEM/SOAR)



and on-premises syslog servers to detect lateral movements or anomalies.
• Incident Containment: Act as the Tier-2 incident responder for security alerts, following playbook actions to isolate compromised virtual machines (e.g., placing VMs in isolated NSX-T segments).
• Compliance Auditing: Perform regular compliance audits against frameworks such as CIS Benchmarks, NIST, or ISO 27001 to ensure the hybrid infrastructure meets organizational policies. Qualifications & Skills Required:
•

Experience:
3+ years of experience in Cyber Security, Security Operations (SecOps), or Cloud Security.
• Cloud Security Knowledge: Hands-on experience securing workloads in Microsoft Azure (utilizing Microsoft Defender for Cloud, Network Security Groups, and IAM).
• Virtualization Security: Solid understanding of VMware security concepts (vSphere hardening, vCenter access controls) and VMware NSX-T firewall configurations (essential for securing AVS workloads).
• Identity Management: Experience managing hybrid authentication models (Azure AD / Active Directory).
• Log Analysis: Proficiency in querying log data (such as using Kusto Query Language
- KQL in Log Analytics or Azure Sentinel). Preferred:
• Certifications: Microsoft Certified: Azure Security Engineer Associate (AZ-500), CompTIA Security+, or VMware Certified Qualified
- Security (VCP-SEC).
• Infrastructure as Code (IaC) Security: Familiarity with static code analysis tools (such as Checkov or tfsec) to scan Terraform templates for security flaws.

📌 Security Specialist (India)
🏢 ITC Infotech
📍 India