Role: L2 Security Specialist

Location: Pune / Hyderabad

Experience Level: 3 to 5 years

Position Overview

We are seeking an analytical and vigilant L2 Security Specialist to join the cybersecurity operations team supporting the Project. The infrastructure is a complex hybrid environment spanning native Microsoft Azure, Azure VMware Solution (AVS), and on-premises data centers.

In this role, you will be the core technical guardian of the project’s security boundaries. You will secure workloads across public cloud, virtualized VMware software-defined data centers (SDDCs), and legacy physical hardware. Your mission is to implement zero-trust network configurations, manage hybrid identities, ensure strict vulnerability governance, and lead the technical response to security events across all environments.

Key Responsibilities

1. Hybrid Network Security & Micro-segmentation

- NSX-T & Cloud Firewalls: Manage and audit distributed firewall rules within VMware NSX-T for the Azure VMware Solution (AVS) cluster, as well as native Azure Network Security Groups (NSGs) and Application Security Groups (ASGs).
- Micro-segmentation Strategy: Define and implement granular micro-segmentation policies to isolate application workloads across native Azure, AVS guest environments, and on-premises physical servers.
- Cross-Boundary Encryption: Ensure all transit data moving over VPNs, ExpressRoute, and Azure Global Reach is securely encrypted using IPsec or TLS protocols.

2. Identity & Access Governance

- Hybrid Identity: Administer and monitor identity syncs and federations between Microsoft Entra ID (Azure AD)



and on-premises Active Directory Domain Services (AD DS).
- Access Control (RBAC): Enforce the principle of least privilege by configuring and maintaining Role-Based Access Control (RBAC) across Azure subscriptions, AVS vCenter instances, and on-premises virtualization hosts.
- MFA & Conditional Access: Implement and audit Conditional Access Policies, Multi-Factor Authentication (MFA), and Privileged Identity Management (PIM) for project personnel.

3. Vulnerability & Threat Management

- Vulnerability Scanning: Schedule and evaluate regular vulnerability scans across hybrid VM operating systems, containerized workloads, and hypervisor management interfaces using tools like Microsoft Defender for Cloud or Qualys.
- Patch Compliance Governance: Work closely with the DevOps and Infrastructure teams to track patch compliance and prioritize remediations for CVEs affecting virtual machines in Azure and AVS.
- Secrets Management: Securely manage certificates, connection strings, API keys, and cryptographic keys using Azure Key Vault and on-premises hardware security modules (HSMs).

4. Security Monitoring & Incident Response

- SIEM Management: Collect, analyze, and query security logs (using KQL) inside Azure Sentinel (SIEM/SOAR)



and on-premises syslog servers to detect lateral movements or anomalies.
- Incident Containment: Act as the Tier-2 incident responder for security alerts, following playbook actions to isolate compromised virtual machines (e.g., placing VMs in isolated NSX-T segments).
- Compliance Auditing: Perform regular compliance audits against frameworks such as CIS Benchmarks, NIST, or ISO 27001 to ensure the hybrid infrastructure meets organizational policies.

Qualifications & Skills

Required:

- Experience: 3+ years of experience in Cyber Security, Security Operations (SecOps), or Cloud Security.
- Cloud Security Knowledge: Hands-on experience securing workloads in Microsoft Azure (utilizing Microsoft Defender for Cloud, Network Security Groups, and IAM).
- Virtualization Security: Solid understanding of VMware security concepts (vSphere hardening, vCenter access controls) and VMware NSX-T firewall configurations (essential for securing AVS workloads).
- Identity Management: Experience managing hybrid authentication models (Azure AD / Active Directory).
- Log Analysis: Proficiency in querying log data (such as using Kusto Query Language - KQL in Log Analytics or Azure Sentinel).

Preferred:

- Certifications: Microsoft Certified: Azure Security Engineer Associate (AZ-500), CompTIA Security+, or VMware Certified Qualified - Security (VCP-SEC).
- Infrastructure as Code (IaC) Security: Familiarity with static code analysis tools (such as Checkov or tfsec) to scan Terraform templates for security flaws.

📌 Security Specialist (Maharashtra)
🏢 ITC Infotech
📍 Maharashtra