Must have skills
- Architected and productised identity security services (reference architecture, platform evaluation and selection, service definition), not implementation only
- Active Directory and Microsoft Entra ID security internals (Kerberos, ACLs, delegation, tiering, conditional access, token model); Okta an advantage
- Identity attack techniques at reproduction depth, mapped to MITRE ATT&CK; credential access, privilege escalation, lateral movement and persistence (Kerberoasting, pass-the-hash/ticket, DCSync, ADCS abuse, token theft and replay, MFA fatigue, OAuth and consent abuse), and the telemetry each leaves
- Attack path analysis as a graph problem, including cloud role escalation (BloodHound, PingCastle, Purple Knight)
- ITDR platforms: hands-on with at least one of Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, Silverfort, Semperis, Vectra AI
- ISPM platforms: hands-on with at least one of Radiant Logic, Semperis, Veza, Tenable Identity Exposure, Silverfort




- Detection engineering and behavioural baselining (Sentinel/KQL, Splunk, Sigma), with detection coverage mapped to MITRE ATT&CK; and false-positive management
- Response automation and containment design: SOAR playbooks, API-level containment actions, containment authority model
- Security operations fluency: has introduced detection content or containment authority into a SOC and can hold the alert-quality conversation Valuable to have
- Threat hunting and deception design (honeytokens, decoy accounts)
- Exposure management platforms (Tenable One, Microsoft Security Exposure Management, Wiz)
- PAM platforms at API level (Idira/CyberArk, BeyondTrust) as signal and containment lever
- NIS2 and DORA incident reporting obligations; GDPR constraints on behavioural monitoringRole & responsibilities Preferred candidate profile

📌 Identity Threat (Bengaluru)
🏢 Atos
📍 Bengaluru