Job Title: Team Lead – Threat Monitoring & Analysis

Department: Information Security / Cyber Defense

Reports To: Chief Information Security Officer (CISO) / Head of Information Security

Location: Bhubaneswar, Odisha (In office)

Employment Type: Full-Time

Company Introduction-

iServeU is a modern banking infrastructure provider in APAC region, empowering financial enterprises with embedded fintech solutions for their customers. iServeU is one of the few certified partners with National Payment Corporation of India (NPCI), VISA for various products.

iServeU also provides a cloud-native, micro services-enabled, distributed platform with over 5000 possible product configurations with a low code/no code interface to banks, NBFCs, Fintech, and other regulated entities.

- We process around 2500 transactions per second by levering distributed & auto scale technology like K8.
- Our core platform combines of 1200+ micro services.
- Our customer list includes Fintech start-ups, top tier private banks to PSU bank. We operate in five countries and help customers constantly change the way financial institutions operate and innovate.
- Our solutions currently empowers over 20 banks and 250+ enterprises across India and abroad.
- Our platform seamlessly manages the entire transaction lifecycle, including withdrawals, deposits, transfers, payments, and lending through various channels like digital, branch, agents.

Our team of 500+ employees, with over 80% in technology roles is spread across offices in Bhubaneswar, Bangalore and Delhi. We have raised $8 million in funding to support our growth and innovation.

For more details visit: www.iserveu.in

​

Position Overview

We are seeking an experienced Team Lead – Threat Monitoring & Analysis to be based in Bhubaneswar, Odisha, to establish and lead a dedicated defensive security monitoring function. Operating independently from our Site Reliability Engineering (SRE) and infrastructure teams, this team focuses exclusively on continuous network security monitoring, threat detection engineering, and deep log/behavioral analysis. In this role, you will direct a team of security analysts, establish our detection and threat-hunting capabilities, oversee out-of-band telemetry ingestion, and serve as the technical escalation authority for security incidents. You will manage monitoring infrastructure across our Linux workloads, microservices, and network channels, ensuring proactive detection and scoping of adversaries before operational impact occurs.

Prerequisite Experience (Mandatory Baseline)





Prior to applying, candidates must demonstrate proven, hands-on experience in the following specific scenarios: 1. Root-Level Incident & Compromise Handling: Demonstrated track record of investigating, scoping, and analyzing live Linux root-level security compromises, persistence mechanisms (cron/systemd/ld.so.preload), or kernel space anomalies.

2. Out-of-Band Telemetry Architecture: Practical experience setting up or managing isolated, read-only out-of-band security ingestion pipelines and SIEM/WORM storage decoupled from primary production administrative access.

3. SRE & Operations Boundary Enforcement: Proven experience defining clear technical boundaries, escalation SLAs, and read-only separation of duties between security analysis teams and SRE/DevOps operational teams.

4. Custom Detection & Parser Engineering: Direct experience building, testing, and deploying custom threat signatures (Sigma, YARA, Suricata/Zeek rules) and system call telemetry (auditd, eBPF/Falco) rather than relying solely on out-of-the-box vendor configurations.

Key Responsibilities

1. Technical Leadership & Detection Engineering

● Design, implement, and lead the Threat Monitoring & Analysis strategy targeting Linux kernel integrity, network telemetry, and microservices security. ● Map detection logic and alert coverage against established frameworks (e.g., MITRE ATT&CK;), focusing on privilege escalation, lateral movement, persistence mechanisms, and exfiltration vectors.

● Establish alert quality control standards to maintain a low false-positive rate and prevent analyst burnout across SIEM, NIDS/HIDS, and endpoint detection platforms.

● Lead proactive threat-hunting exercises using low-level system telemetry (auditd, eBPF, network flow logs, and system call traces).

2. Incident Triage, Escalation & Handoff

● Serve as the senior escalation point to validate, scope, and classify security anomalies and suspected breaches. ● Author clear, evidence-backed incident escalation packages (timelines, IOCs, affected assets, and recommended containment steps) for execution by SRE/DevOps teams.

● Lead security-focused Root Cause Analysis (RCA)



retrospectives following security events to refine detection signatures and address visibility gaps.

3. Team Management & Operational Governance

● Manage day-to-day operations, shift handovers, and performance metrics (MTTD, MTTE, Detection Precision) for the threat analysis team. ● Maintain step-by-step incident investigation playbooks and detection runbooks.

● Enforce strict operational boundaries: ensure threat monitoring tools operate read-only out-of-band without direct production execution rights.

● Oversee continuous monitoring of privileged access, SSH usage, and infrastructure deployment pipelines to detect unauthorized administrative actions.

Requirements

● Experience: Minimum of 7+ years in Incident Response, Security Operations (SOC), Threat Hunting, or Threat Detection Engineering, with at least 2+ years leading technical security teams. ● Location & Work Setup: Based in or willing to relocate to Bhubaneswar, Odisha.

● Linux Deep-Dive: Advanced knowledge of Linux operating system internals, security architectures (auditd, eBPF, PAM, /etc integrity, process tracing), and root-level threat vectors (rootkits, library preloading, dynamic linker hijacking).

● Network & Traffic Analysis: Strong proficiency with deep packet inspection (DPI), network flow analysis (Zeek/Suricata/Snort), and identifying command-and-control (C2) dynamic DNS, reverse shells, or exfiltration channels.

● Detection & SIEM Tools: Extensive experience configuring SIEMs, log ingestion pipelines, YARA rules, and Sigma detection logic.

● Scripting & Analytics: Hands-on proficiency in Python, Bash, or Go for custom log parsing, API integrations, and threat intelligence ingestion.

Preferred Qualifications

● Relevant industry certifications: GIAC (GCIH, GCIA, GNFA), CISSP, Certified Threat Intelligence Analyst (CTIA), or equivalent practical credentials. ● Experience setting up write-once/read-many (WORM) or out-of-band security log pipelines isolated from primary production networks.

● Familiarity with microservices, container security (Kubernetes/Docker runtime monitoring), and cloud telemetry.

Key Operational Metrics & KPIs

● Mean Time to Detect (MTTD): Minimize time elapsed between adversary activity and initial validation. ● Detection Precision: Maintain an actionable alert-to-noise ratio exceeding 80%.

● MITRE ATT&CK; Coverage: Expand detection rule coverage across high-risk post-exploitation tactics year-over-year.

📌 Team Lead – Threat Monitoring & Analysis (Bhubaneswar)
🏢 iServeU Technology
📍 Bhubaneswar