Role purpose: Operate and improve Group EDR and SIEM capabilities, investigate alerts, build detections and support incident response across Tanla Group [Tanla Platforms, Karix and ValueFirst]

Expected outcomes: Evidence-based alert investigations and timely escalations; reliable telemetry and endpoint health tracking; tested detections with documented tuning; complete incident records and reusable investigation playbooks.

What You’ll be Responsible For?

- Monitor, triage and investigate EDR and SIEM alerts; establish the affected host, user, timeline, likely cause and business impact using supporting evidence.
- Perform endpoint and log analysis for suspicious processes, authentication activity, persistence, malware and other attack indicators. Escalate incidents with clear findings and recommended actions.
- Develop and tune detection queries, correlation rules, dashboards and investigation workflows under the SOC Manager’s direction; test effectiveness and document changes.
- Conduct scoped threat hunts and map detection coverage to relevant attack techniques and current organizational risks.
- Onboard and validate log sources; troubleshoot missing telemetry, connector failures, parsing issues and data quality with platform and infrastructure owners.
- Track EDR deployment, connectivity, protection health and approved exceptions. Coordinate agent health and coverage fixes with entity teams.
- Maintain incident records, evidence, investigation notes, playbooks and shift or on-call handovers. Carry out response actions only under the approved authorization process.




- Automate repeatable analysis and reporting where appropriate; support operational metrics and audit evidence.

What we’ll look in you ?

- 4–5 years of relevant SOC, security engineering or incident investigation experience, with hands-on EDR and SIEM operations.
- Experience with Cortex XDR / XSIAM or equivalent tools; ability to write and troubleshoot query languages such as XQL, KQL or SPL.
- Working knowledge of Windows and Linux event sources, endpoint processes, TCP/IP, DNS, HTTP/S and identity authentication logs; macOS familiarity is desirable.
- Ability to correlate evidence across sources, distinguish confirmed findings from assumptions and produce actionable investigation notes.
- Practical scripting skills in Python, PowerShell or shell; strong troubleshooting, critical thinking and collaboration.
- Education – BE / B.Tech / MCA - Computer Science, Engineering or a related discipline, or equivalent practical experience.
- Certifications - Security+, CySA+, GCIH or EDR / SIEM vendor certifications are desirable, not mandatory.

Why join us?

- Impactful Work: Play a key role in strengthening HR operations and delivering a seamless employee experience across the organisation.
- Tremendous Growth Opportunities: Be part of a rapidly growing company with opportunities to build and improve HR processes and practices.
- Innovative Environment: Work alongside a collaborative team in a agile environment where ownership, accountability and innovation are valued.

Tanla is an equal opportunity employer. We champion diversity and are committed to creating an inclusive environment for all employees. www.tanla.com

📌 Senior Application Security Engineer (Hyderabad)
🏢 Tanla Platforms
📍 Hyderabad