Location: Pune Employment Type: full-time

Job Details

Position Summary The Threat Management Lead will be responsible for strengthening the organization's cybersecurity threat detection and response capabilities through proactive threat hunting, detection engineering, and threat intelligence analysis. The role will lead initiatives to identify emerging cyber threats, develop and optimize security detection mechanisms, and improve visibility across the organization's IT infrastructure, applications,and cloud environments. The individual will leverage internal security telemetry, external threat intelligence feeds, and industry threat-sharing communities to identify potential attack patterns, develop actionable detection strategies,

and proactively uncover adversarial activities that may bypass conventional security controls.

The role requires prior hands-on experience as a SOC Analyst, along with strong expertise in threat detection, security monitoring, incident investigation, and threat hunting.

Key Responsibilities

Detection Engineering

- Design, develop, implement, and continuously fine-tune custom threat detection rules and use cases.
- Map detection capabilities and security monitoring coverage against the MITRE ATT&CK; framework.
- Identify detection gaps across endpoints, networks, applications, cloud platforms, and enterprise environments.
- Develop and optimize SIEM detection rules,correlation logic, behavioral analytics, and automated alerts.
- Collaborate with SOC and incident response teams to improve detection accuracy and minimize false positives.
- Develop and enhance threat detection use cases to identify unauthorized access, suspicious activity, data exfiltration, and potential compromise involving sensitive healthcare information and patient data.
- Design and optimize security monitoring mechanisms to detect anomalous access patterns, potential data breaches, and threats targeting systems that store, process, or transmit Electronic Protected Health Information (ePHI).

Threat Intelligence Management

- Collect, analyze, and operationalize threat intelligence from internal security telemetry, commercial intelligence feeds, open-source intelligence (OSINT), and Information Sharing and Analysis Centers (ISACs).
- Analyze emerging threat actors, attack techniques,indicators of compromise (IOCs), and adversarial tactics.




- Translate threat intelligence into actionable detection rules, threat-hunting hypotheses, and security priorities.
- Maintain awareness of evolving cyber threats,vulnerabilities, attack campaigns, and industry-specific risks.
- Establish processes for integrating threat intelligence into security monitoring and incident response operations.

Proactive Threat Hunting

- Lead proactive threat-hunting activities to identify suspicious behavior and advanced adversarial activities that may bypass automated security tools.
- Develop threat-hunting hypotheses based on intelligence reports, MITRE ATT&CK; techniques, and observed security events.
- Investigate abnormal activities across endpoint, network, identity, application, and cloud environments.
- Perform advanced log analysis, event correlation, and behavioral analysis to uncover hidden threats.
- Document hunting findings and translate identified threats into improved detection mechanisms and security controls.

SOC Operations & Incident Investigation

- Leverage previous SOC Analyst experience to support security monitoring, alert triage, incident investigation, and threat analysis.
- Work closely with SOC analysts and incident response teams to improve threat detection and investigation processes.
- Support root cause analysis of security incidents and recommend preventive and corrective security measures.
- Improve SOC detection maturity through continuous feedback, knowledge sharing, and process optimization.

Leadership & Continuous Improvement

- Provide technical leadership and guidance to SOC analysts and threat detection engineers.
- Establish detection engineering and threat-hunting standards, methodologies, and operational metrics.
- Track detection coverage, threat-hunting effectiveness, false-positive rates, and detection gaps.
- Collaborate with infrastructure, cloud, application security, and security operations teams to strengthen the organization's overall security posture.

Mandatory Skills & Qualifications

- 8–10 years of experience in cybersecurity,



with prior hands-on experience as a SOC Analyst.
- Strong experience in threat detection engineering, threat intelligence analysis, and proactive threat hunting.
- Hands-on experience with SIEM platforms such as Microsoft Sentinel, Splunk, IBM QRadar, or similar tools.
- Strong understanding of the MITRE ATT&CK; framework and adversary tactics, techniques, and procedures (TTPs).
- Experience developing, implementing, and tuning custom detection rules and correlation use cases.
- Strong knowledge of endpoint, network, identity, application, and cloud security monitoring.
- Experience analyzing IOCs, security logs, behavioral patterns, and threat intelligence feeds.
- Robust understanding of security incident investigation, malware behavior, attack patterns, and cyber threat landscape.
- Ability to translate threat intelligence and hunting findings into actionable detection capabilities.
- Understanding of security threats and monitoring requirements relevant to healthcare environments, including threats targeting patient information, healthcare applications, and systems containing Electronic Protected Health Information (ePHI).
- Knowledge of healthcare data security, patient information protection, and security monitoring requirements associated with sensitive healthcare information.
- Strong analytical, investigative, problem-solving, and communication skills.

Good-to-Have Skills

- Experience with EDR/XDR platforms such as CrowdStrike Falcon, Microsoft Defender, or Sentinel One.
- Knowledge of detection languages and framework such as Sigma, YARA, KQL, SPL, or EQL.
- Experience with SOAR platforms and security automation.
- Understanding of cloud security monitoring across AWS, Azure, or GCP.
- Relevant certifications such as GIAC Certified Detection Analyst (GCDA), GIAC Certified Intrusion Analyst (GCIA), GIAC Cyber Threat Intelligence (GCTI), or equivalent.
- Experience working with commercial threat intelligence platforms and ISAC communities, HIPAA awareness

Experience & Education

- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.
- 8–10 years of relevant cybersecurity experience.
- Prior experience working in a Security Operations Center (SOC) is mandatory.
- Experience leading or mentoring technical security teams is preferred.

📌 Threat Management Lead (Pune)
🏢 systems plus
📍 Pune