Security Operations Analyst

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an ICC - Security Operations Analyst - Cyber Defense based in India.

• Monitor, triage, and investigate security alerts across SIEM, EDR, Microsoft security technologies, and cloud platforms.
• Analyze logs and security events from Windows and Linux systems, databases, applications, web servers, firewalls, and network intrusion detection systems.
• Investigate suspicious activity, determine potential root causes, and assess the severity and impact of security incidents.
• Support incident response, remediation, recovery, and containment activities in coordination with relevant cybersecurity teams.
• Determine appropriate escalation paths and collaborate with Incident Response specialists when threats require deeper investigation.
• Identify opportunities to improve detection quality, optimize security monitoring, reduce false positives, and tune whitelists.
• Prepare technical reports, investigation summaries, and security findings for relevant stakeholders.
• Maintain SOC procedures, technical documentation, playbooks, and knowledge-base content.
• Contribute to operational improvements, process optimization, and cybersecurity quality initiatives.

• 5+ years of relevant IT and/or cybersecurity experience, with hands-on experience in security operations.
• Proven experience with security alert triage, threat investigation, and incident response processes.
• Practical experience working with SIEM and EDR platforms in enterprise environments.
• Strong log analysis capabilities across Windows/Linux systems and broader enterprise infrastructure.
• Deep knowledge of Microsoft Security technologies.
• Experience with at least one major cloud environment, such as Azure, AWS, or GCP.
• Experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, ArcSight, or ELK.
• Experience with EDR solutions such as Microsoft Defender for Endpoint or CrowdStrike.
• Knowledge of email security, network monitoring, threat detection, and incident response.
• Strong knowledge of Linux, macOS, and Windows operating systems.
• Fluent English with strong written and verbal communication skills.
• Ability to work effectively within global, distributed cybersecurity teams and coordinate investigations across different functions.

• Tier 1 or Tier 2 incident response experience.
• Experience with AWS security monitoring across IaaS, PaaS, or SaaS environments.
• Scripting experience with Python, PowerShell, Bash, Ruby, or similar languages.
• Relevant certifications such as SC-200, GCIH, CEH, GCFA, GIAC, CCNA, or MCSE.
• Previous experience working in a global SOC or distributed cybersecurity operation.

• Full-time remote work from India.
• Six-month contract with potential for extension.
• Opportunity to work within a global 24/7 Security Operations Centre.
• Exposure to a broad cybersecurity technology stack spanning SIEM, EDR, cloud, network, endpoint, and enterprise security.
• Collaboration with cybersecurity specialists across multiple regions and technical disciplines.
• Hands-on experience with real-world threat detection, investigation, incident response, and remediation.
• Opportunity to contribute to security monitoring optimization and operational improvement initiatives.
• Globally distributed and remote-first working environment.
• Inclusive and transparent recruitment environment.