Purpose

Act as a senior SOC technical expert responsible for advanced threat detection, complex incident response, threat hunting, detection engineering, and continuous improvement of SOC capabilities. Provide technical leadership during high-severity cybersecurity incidents and guide L1/L2 analysts.

Area of Responsibility

- Advanced incident response and technical leadership.
- Major/high-severity incident investigation.
- Advanced threat hunting.
- Detection engineering and SIEM use-case development.
- EDR/XDR investigation and response.
- Malware and attack-chain analysis.
- SOC automation and orchestration.
- Threat intelligence integration.
- SOC capability and process improvement.
- Technical mentoring and quality assurance.

Tasks

- Lead investigations of complex and high-severity cybersecurity incidents.
- Conduct deep-dive analysis across endpoint, network, identity, email, cloud, and security telemetry.
- Identify attacker TTPs, attack paths, persistence mechanisms, lateral movement, and compromised assets.
- Lead containment, eradication, recovery, and post-incident analysis activities.
- Perform advanced threat hunting based on emerging threats, intelligence, threat hypotheses, and behavioral indicators.
- Design, develop, test, and tune SIEM detection rules and analytics.
- Develop detection coverage mapped to MITRE ATT&CK; techniques.
- Identify visibility and detection gaps and recommend improvements to security controls.
- Develop or enhance SOAR automation and incident-response workflows.
- Support malware analysis, forensic investigation, and evidence collection where required.
- Lead root-cause analysis and preparation of detailed incident reports.




- Conduct post-incident reviews and convert lessons learned into detection and process improvements.
- Mentor L1/L2 analysts and provide technical guidance during complex investigations.
- Collaborate with Cyber Threat Intelligence, Incident Response, Digital Forensics, Vulnerability Management, IAM, network, cloud, and infrastructure teams.
- Support continuous improvement of SOC KPIs, playbooks, runbooks, and operating procedures.

Knowledge

- Expert understanding of SOC operations, threat detection, and incident response.
- Robust knowledge of SIEM, EDR/XDR, SOAR, IDS/IPS, firewall, identity, email, cloud, and network security technologies.
- Deep understanding of Windows/Linux internals, Active Directory, Entra ID, endpoint, network, and cloud attacks.
- Advanced knowledge of MITRE ATT&CK; and attacker TTPs.
- Knowledge of threat hunting, malware analysis, digital forensics, and threat intelligence.
- Understanding of detection engineering principles and security telemetry.
- Knowledge of major incident response and post-incident review methodologies.

Skills

- Advanced expertise with SIEM platforms such as Microsoft Sentinel, Splunk, or IBM QRadar.
- Advanced investigation using Microsoft Defender XDR, CrowdStrike, SentinelOne, or equivalent platforms.
- Advanced KQL, SPL, or other security query languages.
- Threat hunting and detection engineering.
- Advanced incident investigation and root-cause analysis.
- SOAR/playbook development and security automation.
- Scripting using Python and/or PowerShell.
- Ability to lead critical incident investigations and coordinate multiple technical teams.
- Strong stakeholder communication, documentation, mentoring, and technical leadership skills.

📌 SOC Analyst (Hyderabad)
🏢 Wipro
📍 Hyderabad